<?xml version="1.0" encoding="UTF-8"?>
<procmon><processlist><process>
<ProcessIndex>1</ProcessIndex>
<ProcessId>4288</ProcessId>
<ParentProcessId>3764</ParentProcessId>
<ParentProcessIndex>7</ParentProcessIndex>
<AuthenticationId>00000000:00021a24</AuthenticationId>
<CreateTime>130411457977757174</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>High</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Procmon.exe</ProcessName>
<ImagePath>F:\Procmon.exe</ImagePath>
<CommandLine>&quot;F:\Procmon.exe&quot; </CommandLine>
<CompanyName>Sysinternals - www.sysinternals.com</CompanyName>
<Version>3.10</Version>
<Description>Process Monitor</Description>
<modulelist>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x90000</BaseAddress>
<Size>2547712</Size>
<Path>F:\Procmon.exe</Path>
<Version>3.10</Version>
<Company>Sysinternals - www.sysinternals.com</Company>
<Description>Process Monitor</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x70c70000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\napinsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>E-mail Naming Shim Provider</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x719c0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\FLTLIB.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Filter Library</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\NLAapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\System32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981112934</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>2</ProcessIndex>
<ProcessId>1772</ProcessId>
<ParentProcessId>1884</ParentProcessId>
<ParentProcessIndex>3</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411321565862468</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Explorer.EXE</ProcessName>
<ImagePath>C:\Windows\Explorer.EXE</ImagePath>
<CommandLine>C:\Windows\Explorer.EXE</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Explorer</Description>
<modulelist>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x690000</BaseAddress>
<Size>2625536</Size>
<Path>C:\Windows\Explorer.EXE</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Explorer</Description>
</module>
<module>
<Timestamp>130411458504983980</Timestamp>
<BaseAddress>0x1a00000</BaseAddress>
<Size>36864</Size>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Version>2.0.50727.4927 (NetFXspW7.050727-4900)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Error Reporting Shim</Description>
</module>
<module>
<Timestamp>130411458271108482</Timestamp>
<BaseAddress>0x3900000</BaseAddress>
<Size>151552</Size>
<Path>C:\Hauppauge\WinTV v7 CD 2.4d\Setup.exe</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457984091161</Timestamp>
<BaseAddress>0x3930000</BaseAddress>
<Size>278528</Size>
<Path>C:\Program Files\Mozilla Firefox\firefox.exe</Path>
<Version>28.0</Version>
<Company>Mozilla Corporation</Company>
<Description>Firefox</Description>
</module>
<module>
<Timestamp>130411458285475523</Timestamp>
<BaseAddress>0x39f0000</BaseAddress>
<Size>151552</Size>
<Path>C:\Hauppauge\WinTV v7 CD 2.4d\Setup.exe</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411458274826016</Timestamp>
<BaseAddress>0x3f00000</BaseAddress>
<Size>212992</Size>
<Path>F:\mirc732.exe</Path>
<Version>7.32</Version>
<Company>mIRC Co. Ltd.</Company>
<Description>mIRC</Description>
</module>
<module>
<Timestamp>130411458274803911</Timestamp>
<BaseAddress>0x5850000</BaseAddress>
<Size>458752</Size>
<Path>F:\mkvtoolnix-6.8.0-setup.exe</Path>
<Version>6.8.0</Version>
<Company>Moritz Bunkus</Company>
<Description>MKVToolNix 6.8.0</Description>
</module>
<module>
<Timestamp>130411458274792865</Timestamp>
<BaseAddress>0x6500000</BaseAddress>
<Size>524288</Size>
<Path>F:\gimp-setup.exe</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411458363568319</Timestamp>
<BaseAddress>0x65a0000</BaseAddress>
<Size>761856</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411458297442237</Timestamp>
<BaseAddress>0x97c0000</BaseAddress>
<Size>4853760</Size>
<Path>C:\Program Files\AVAST Software\Avast\AvastUI.exe</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Antivirus</Description>
</module>
<module>
<Timestamp>130411458274748807</Timestamp>
<BaseAddress>0xaf10000</BaseAddress>
<Size>2203648</Size>
<Path>F:\MediaInfo_GUI_0.7.68_Windows.exe</Path>
<Version>0.7.68.0</Version>
<Company>MediaArea.net</Company>
<Description>All about your audio and video files</Description>
</module>
<module>
<Timestamp>130411458274761677</Timestamp>
<BaseAddress>0xb130000</BaseAddress>
<Size>7536640</Size>
<Path>F:\CoffeeFreeFTPInstaller4.5.exe</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>69632</Size>
<Path>C:\Program Files\7-Zip\7-zip.dll</Path>
<Version>9.22 beta</Version>
<Company>Igor Pavlov</Company>
<Description>7-Zip Shell Extension</Description>
</module>
<module>
<Timestamp>130411457992774458</Timestamp>
<BaseAddress>0x10020000</BaseAddress>
<Size>145133568</Size>
<Path>F:\Encoders\CCE.2.70.02.12\cctspt.exe</Path>
<Version>2, 70, 2, 12</Version>
<Company>Custom Technology Corporation</Company>
<Description>CCE SP Trial Version</Description>
</module>
<module>
<Timestamp>130411458274808826</Timestamp>
<BaseAddress>0x5e180000</BaseAddress>
<Size>20275200</Size>
<Path>C:\Windows\System32\imageres.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Resource</Description>
</module>
<module>
<Timestamp>130411458285147132</Timestamp>
<BaseAddress>0x633c0000</BaseAddress>
<Size>9596928</Size>
<Path>C:\Windows\system32\Macromed\Flash\Flash11e.ocx</Path>
<Version>11,1,102,55</Version>
<Company>Adobe Systems, Inc.</Company>
<Description>Adobe Flash Player 11.1 r102</Description>
</module>
<module>
<Timestamp>130411458285142327</Timestamp>
<BaseAddress>0x63cf0000</BaseAddress>
<Size>9596928</Size>
<Path>C:\Windows\system32\Macromed\Flash\Flash11e.ocx</Path>
<Version>11,1,102,55</Version>
<Company>Adobe Systems, Inc.</Company>
<Description>Adobe Flash Player 11.1 r102</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67a00000</BaseAddress>
<Size>1073152</Size>
<Path>C:\Windows\System32\werconcpl.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PRS CPL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67b10000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\System32\wscui.cpl</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Action Center</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67c30000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\system32\MLANG.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi Language Support DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67c70000</BaseAddress>
<Size>45056</Size>
<Path>C:\Program Files\Windows Media Player\wmpnssui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player WMPNSS Shell Extensions</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67c80000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\Windows Photo Viewer\PhotoBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Photo Base Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67c90000</BaseAddress>
<Size>1466368</Size>
<Path>C:\Program Files\Windows Photo Viewer\PhotoViewer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Photo Viewer</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67e00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\SYNCENG.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Briefcase Engine</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67e20000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\syncui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Briefcase</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67e50000</BaseAddress>
<Size>184320</Size>
<Path>C:\Program Files\WinRAR\rarext.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x67e80000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\twext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Previous Versions property page</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x68590000</BaseAddress>
<Size>3219456</Size>
<Path>C:\Windows\System32\mf.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x68950000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\System32\StructuredQuery.dll</Path>
<Version>7.00.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Structured Query</Description>
</module>
<module>
<Timestamp>130411457984859390</Timestamp>
<BaseAddress>0x68a10000</BaseAddress>
<Size>495616</Size>
<Path>C:\Windows\System32\DeviceCenter.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Center</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6a580000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\thumbcache.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Thumbnail Cache</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6a5f0000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\System32\hgcpl.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>HomeGroup Control Panel</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6b070000</BaseAddress>
<Size>929792</Size>
<Path>C:\Windows\system32\FXSRESM.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft  Fax Resource DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6b160000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\FXSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft  Fax API Support DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6b1a0000</BaseAddress>
<Size>860160</Size>
<Path>C:\Windows\system32\fxsst.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fax Service</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6b5a0000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\System32\QAgent.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Quarantine Agent Proxy</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6b5d0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wwapi.dll</Path>
<Version>08.01.02.00 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WWAN API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6b5e0000</BaseAddress>
<Size>294912</Size>
<Path>C:\Windows\system32\wwanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Mbnapi</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6ba70000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\mssprxy.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Search Proxy</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6bbf0000</BaseAddress>
<Size>315392</Size>
<Path>C:\Windows\System32\srchadmin.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Indexing Options</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6bc40000</BaseAddress>
<Size>9719808</Size>
<Path>C:\Windows\System32\ieframe.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Browser</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6c590000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\System32\cscobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>In-proc COM object used by clients of CSC API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6c5c0000</BaseAddress>
<Size>720896</Size>
<Path>C:\Windows\System32\bthprops.cpl</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Bluetooth Control Panel Applet</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6c670000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\PortableDeviceTypes.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device (Parameter) Types Component</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6c6a0000</BaseAddress>
<Size>118784</Size>
<Path>C:\Windows\system32\wpdshserviceobj.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device Shell Service Object</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6c6c0000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\QUtil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Quarantine Utilities</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6c6e0000</BaseAddress>
<Size>1761280</Size>
<Path>C:\Windows\System32\pnidui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network System Icon</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6c8b0000</BaseAddress>
<Size>409600</Size>
<Path>C:\Windows\system32\dxp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Stage Shell Extension</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6ca80000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Internet Explorer\ieproxy.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>IE ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6cba0000</BaseAddress>
<Size>761856</Size>
<Path>C:\Windows\System32\Actioncenter.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Action Center</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6d5e0000</BaseAddress>
<Size>409600</Size>
<Path>C:\Windows\system32\imapi2.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Image Mastering API v2</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6d7a0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\AltTab.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Alt Tab</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6d7b0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\d3d8thk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Direct3D OS Thunk Layer</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6d7c0000</BaseAddress>
<Size>1847296</Size>
<Path>C:\Windows\system32\d3d9.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Direct3D 9 Runtime</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6d990000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\ehome\ehSSO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Center Shell Service Object</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6dab0000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\wercplsupport.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Problem Reports and Solutions</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6dfd0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\hcproviders.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Action Center Providers</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6dfe0000</BaseAddress>
<Size>106496</Size>
<Path>C:\Windows\System32\wscinterop.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Health Center WSC Interop</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6e3d0000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\wdmaud.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winmm  audio system driver</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6ecb0000</BaseAddress>
<Size>2588672</Size>
<Path>C:\Windows\System32\gameux.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Games Explorer</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f320000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\System32\provsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HomeGroup</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f3d0000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\Syncreg.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Synchronization Framework Registration</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f450000</BaseAddress>
<Size>2154496</Size>
<Path>C:\Windows\System32\SyncCenter.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sync Center</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f660000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\msiltcfg.dll</Path>
<Version>5.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Installer Configuration API Stub</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f670000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\midimap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MIDI Mapper</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f8d0000</BaseAddress>
<Size>458752</Size>
<Path>C:\Windows\system32\ntshrui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell extensions for sharing</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\CSCAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f950000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\CSCDLL.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Temporary Shim</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f960000</BaseAddress>
<Size>434176</Size>
<Path>C:\Windows\System32\cscui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Side Caching UI</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6f9d0000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\system32\EhStorShell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage Shell Extension DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6fa10000</BaseAddress>
<Size>409600</Size>
<Path>C:\Windows\system32\prnfldr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>prnfldr dll</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6fa80000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\msacm32.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sound Mapper</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6fd90000</BaseAddress>
<Size>2359296</Size>
<Path>C:\Windows\system32\msi.dll</Path>
<Version>5.0.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Installer</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x6ffd0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashShell.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Shell Extension</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x70020000</BaseAddress>
<Size>1503232</Size>
<Path>C:\Windows\system32\EXPLORERFRAME.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ExplorerFrame</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x706f0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\IconCodecService.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Converts a PNG part of the icon to a legacy bmp icon</Description>
</module>
<module>
<Timestamp>130411458363546050</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411458363541471</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x70830000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\fdproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Function Discovery Proxy Dll</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x70870000</BaseAddress>
<Size>749568</Size>
<Path>C:\Windows\system32\BatMeter.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Battery Meter Helper DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x70930000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\stobject.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Systray shell service object</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x70ac0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\System32\OLEACC.dll</Path>
<Version>7.0.0.0 (win7sp1_gdr.110826-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Accessibility Core Component</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x70ef0000</BaseAddress>
<Size>2510848</Size>
<Path>C:\Windows\System32\netshell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connections Shell</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x71830000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\WSCAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\Wlanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\System32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72a50000</BaseAddress>
<Size>1671168</Size>
<Path>C:\Windows\system32\NetworkExplorer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Explorer</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\Windows\system32\CRYPTUI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72cf0000</BaseAddress>
<Size>1798144</Size>
<Path>C:\Windows\system32\authui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Authentication UI</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72eb0000</BaseAddress>
<Size>360448</Size>
<Path>C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Tablet PC Input Panel Text Services Framework</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72f10000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\msls31.dll</Path>
<Version>3.10.349.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Line Services library file</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72f40000</BaseAddress>
<Size>606208</Size>
<Path>C:\Windows\system32\MsftEdit.dll</Path>
<Version>5.41.21.2510</Version>
<Company>Microsoft Corporation</Company>
<Description>Rich Text Edit Control, v4.1</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x72fe0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\LINKINFO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Volume Tracking</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x731c0000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\System32\shdocvw.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Doc Object and Control Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x731f0000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\actxprxy.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73280000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINBRAND.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Branding Resources</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73290000</BaseAddress>
<Size>491520</Size>
<Path>C:\Windows\system32\timedate.cpl</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Time Date Control Panel Applet</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73310000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\HID.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Hid User Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73320000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\SndVolSSO.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SCA Volume</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73380000</BaseAddress>
<Size>122880</Size>
<Path>C:\Windows\System32\shacct.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Accounts Classes</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73400000</BaseAddress>
<Size>163840</Size>
<Path>C:\Windows\system32\RstrtMgr.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Restart Manager</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73470000</BaseAddress>
<Size>94208</Size>
<Path>C:\Program Files\Windows Sidebar\sbdrop.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Sidebar droptarget</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73550000</BaseAddress>
<Size>561152</Size>
<Path>C:\Windows\system32\PortableDeviceApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device API Components</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73630000</BaseAddress>
<Size>397312</Size>
<Path>C:\Windows\System32\wer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73950000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\System32\framedynos.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI SDK Provider Framework</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73da0000</BaseAddress>
<Size>364544</Size>
<Path>C:\Windows\System32\MFPlat.DLL</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Platform DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\MSACM32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x740d0000</BaseAddress>
<Size>290816</Size>
<Path>C:\Windows\system32\es.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\MMDevApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74af0000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\DUser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUser Engine</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\Windows\system32\DUI70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74be0000</BaseAddress>
<Size>1638400</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft GDI+</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>C:\Windows\System32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457980797984</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>4</ProcessIndex>
<ProcessId>744</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411323296797540</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\System32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\System32\svchost.exe -k secsvcs</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x65320000</BaseAddress>
<Size>7278592</Size>
<Path>C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{44225E1D-301C-465A-AC82-39D9B68EA299}\mpengine.dll</Path>
<Version>1.1.7702.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Malware Protection Engine</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x67680000</BaseAddress>
<Size>622592</Size>
<Path>C:\Windows\System32\tdh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Event Trace Helper Library</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x67720000</BaseAddress>
<Size>163840</Size>
<Path>c:\program files\windows defender\mprtp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>AntiMalware Realtime Monitor</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x679f0000</BaseAddress>
<Size>61440</Size>
<Path>C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{44225E1D-301C-465A-AC82-39D9B68EA299}\offreg.dll</Path>
<Version>6.1.7600.16385 (win7_wdk.100208-1538)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline registry DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x6df20000</BaseAddress>
<Size>692224</Size>
<Path>c:\program files\windows defender\mpsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Service Module</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x6e010000</BaseAddress>
<Size>405504</Size>
<Path>c:\program files\windows defender\MpClient.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Interface</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\sfc_os.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x71830000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\wscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center API</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\System32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\System32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\system32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457980799323</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>5</ProcessIndex>
<ProcessId>600</ProcessId>
<ParentProcessId>552</ParentProcessId>
<ParentProcessIndex>14</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321452092276</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>services.exe</ProcessName>
<ImagePath>C:\Windows\system32\services.exe</ImagePath>
<CommandLine>C:\Windows\system32\services.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Services and Controller app</Description>
<modulelist>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x910000</BaseAddress>
<Size>266240</Size>
<Path>C:\Windows\system32\services.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Services and Controller app</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75350000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\UBPM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unified Background Process Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75d50000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\SCESRV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Configuration Editor Engine</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75db0000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\scext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Service Control Manager Extension DLL for non-minwin</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255371</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>6</ProcessIndex>
<ProcessId>3392</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411405839110867</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>1</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>VirtualDub.exe</ProcessName>
<ImagePath>F:\Encoders\Virtual Dub\VirtualDub.exe</ImagePath>
<CommandLine>&quot;F:\Encoders\Virtual Dub\VirtualDub.exe&quot; </CommandLine>
<CompanyName></CompanyName>
<Version>1.9.11</Version>
<Description>VirtualDub</Description>
<modulelist>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>2801664</Size>
<Path>F:\Encoders\Virtual Dub\VirtualDub.exe</Path>
<Version>1.9.11</Version>
<Company></Company>
<Description>VirtualDub</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x3340000</BaseAddress>
<Size>53248</Size>
<Path>F:\AVISynth\Dlls\Yadif.dll</Path>
<Version>1, 7, 0, 0</Version>
<Company>A.G.Balakhnin aka Fizick, bag@hotmail.ru, http://avisynth.org.ru</Company>
<Description>Yadif c-plugin for Avisynth v2.5</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x3460000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\system32\lagarith.dll</Path>
<Version>1.3.27</Version>
<Company> </Company>
<Description>Lagarith</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>1470464</Size>
<Path>C:\Windows\system32\DevIL.dll</Path>
<Version>1.6.6</Version>
<Company>Abysmal Software</Company>
<Description>DevIL: A portable image library in development</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x61cd0000</BaseAddress>
<Size>4169728</Size>
<Path>F:\Codecs\ffdshow\ffdshow.ax</Path>
<Version>1.3.4527.0</Version>
<Company></Company>
<Description>DirectShow and VFW video and audio decoding/encoding/processing filter</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x620d0000</BaseAddress>
<Size>2519040</Size>
<Path>C:\Windows\system32\WMVCore.DLL</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Playback/Authoring DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x63060000</BaseAddress>
<Size>1904640</Size>
<Path>C:\Windows\system32\AviSynth.dll</Path>
<Version>2, 6, 0, 3</Version>
<Company>The Public</Company>
<Description>Avisynth video processing scripting language</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x68040000</BaseAddress>
<Size>2326528</Size>
<Path>C:\Windows\system32\wpdshext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Portable Devices Shell Extension</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x68410000</BaseAddress>
<Size>1536000</Size>
<Path>C:\Windows\system32\QUARTZ.dll</Path>
<Version>6.6.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectShow Runtime.</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x68590000</BaseAddress>
<Size>3219456</Size>
<Path>C:\Windows\System32\mf.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x68950000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\System32\StructuredQuery.dll</Path>
<Version>7.00.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Structured Query</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x689c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\WMASF.DLL</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media ASF DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x68c10000</BaseAddress>
<Size>258048</Size>
<Path>C:\Windows\system32\audiodev.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Portable Media Devices Shell Extension</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x68f80000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\MSVFW32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Video for Windows DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6a3e0000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\DINPUT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DirectInput</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6a580000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\thumbcache.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Thumbnail Cache</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6bc40000</BaseAddress>
<Size>9719808</Size>
<Path>C:\Windows\system32\ieframe.DLL</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Browser</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6c890000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\AVIFIL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft AVI File support library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6ca80000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Internet Explorer\ieproxy.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>IE ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6d690000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\EhStorAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage API</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6d7b0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\d3d8thk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Direct3D OS Thunk Layer</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6d7c0000</BaseAddress>
<Size>1847296</Size>
<Path>C:\Windows\system32\d3d9.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Direct3D 9 Runtime</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\CSCAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6f950000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\CSCDLL.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Temporary Shim</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6f960000</BaseAddress>
<Size>434176</Size>
<Path>C:\Windows\System32\cscui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Side Caching UI</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6f9d0000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\system32\EhStorShell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage Shell Extension DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x6ffd0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashShell.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Shell Extension</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x70020000</BaseAddress>
<Size>1503232</Size>
<Path>C:\Windows\system32\explorerframe.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ExplorerFrame</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x70ac0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\OLEACC.dll</Path>
<Version>7.0.0.0 (win7sp1_gdr.110826-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Accessibility Core Component</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\iphlpapi.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x729f0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\DAVHLPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DAV Helper DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x72a00000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\davclnt.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web DAV Client DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x72a20000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\System32\ntlanman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Lan Manager</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x72a40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\drprov.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Remote Desktop Session Host Server Network Provider</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x72a50000</BaseAddress>
<Size>1671168</Size>
<Path>C:\Windows\system32\NetworkExplorer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Explorer</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x72eb0000</BaseAddress>
<Size>360448</Size>
<Path>C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Tablet PC Input Panel Text Services Framework</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x72f10000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\msls31.dll</Path>
<Version>3.10.349.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Line Services library file</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x72fe0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\LINKINFO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Volume Tracking</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x731c0000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\system32\SHDOCVW.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Doc Object and Control Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x731f0000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\actxprxy.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x73460000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\dtsh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Detection and Sharing Status API</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x73550000</BaseAddress>
<Size>561152</Size>
<Path>C:\Windows\system32\PortableDeviceApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device API Components</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x73620000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\NetworkItemFactory.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NetworkItem Factory</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x73740000</BaseAddress>
<Size>65536</Size>
<Path>C:\Program Files\AviSynth 2.5\plugins\ffavisynth.dll</Path>
<Version>1.3.4527.0</Version>
<Company></Company>
<Description>ffdshow AviSynth DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x73da0000</BaseAddress>
<Size>364544</Size>
<Path>C:\Windows\System32\MFPlat.DLL</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Platform DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\MSACM32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\System32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\System32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\xmllite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74af0000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\DUser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUser Engine</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\Windows\system32\DUI70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\propsys.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\dnsapi.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457980938952</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>7</ProcessIndex>
<ProcessId>3764</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411457901922836</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Procmon.exe</ProcessName>
<ImagePath>F:\Procmon.exe</ImagePath>
<CommandLine>&quot;F:\Procmon.exe&quot; </CommandLine>
<CompanyName>Sysinternals - www.sysinternals.com</CompanyName>
<Version>3.10</Version>
<Description>Process Monitor</Description>
<modulelist>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x90000</BaseAddress>
<Size>2547712</Size>
<Path>F:\Procmon.exe</Path>
<Version>3.10</Version>
<Company>Sysinternals - www.sysinternals.com</Company>
<Description>Process Monitor</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x719c0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\FLTLIB.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Filter Library</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981258435</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>8</ProcessIndex>
<ProcessId>4</ProcessId>
<ParentProcessId>0</ParentProcessId>
<ParentProcessIndex>9</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321370660133</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>System</ProcessName>
<ImagePath>System</ImagePath>
<CommandLine></CommandLine>
<CompanyName></CompanyName>
<Version></Version>
<Description></Description>
<modulelist>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x890000</BaseAddress>
<Size>679936</Size>
<Path>C:\Windows\System32\autochk.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Auto Check Utility</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x47a00000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\System32\smss.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Session Manager</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\msasn1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\devobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\System32\wintrust.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\System32\crypt32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x760d0000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\System32\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\System32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\System32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\System32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\System32\ws2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\System32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76980000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\System32\difxapi.dll</Path>
<Version>2.1</Version>
<Company>Microsoft Corporation</Company>
<Description>Driver Install Frameworks for API library module</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\System32\wininet.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\System32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\nsi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\System32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\System32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\System32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\System32\shell32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\System32\Wldap32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x77f50000</BaseAddress>
<Size>327680</Size>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ApiSet Schema DLL</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x80b99000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\kdcom.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Serial Kernel Debugger</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x82e56000</BaseAddress>
<Size>4268032</Size>
<Path>C:\Windows\system32\ntkrnlpa.exe</Path>
<Version>6.1.7601.17640 (win7sp1_gdr.110622-1506)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Kernel &amp; System</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c220000</BaseAddress>
<Size>544768</Size>
<Path>C:\Windows\system32\mcupdate_GenuineIntel.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Intel Microcode Update Library</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c2b6000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\BOOTVID.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>VGA Boot Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c300000</BaseAddress>
<Size>700416</Size>
<Path>C:\Windows\system32\CI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Code Integrity Module</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c3df000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\DRIVERS\cdrom.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SCSI CD-ROM Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c409000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\drivers\fileinfo.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FileInfo Filter Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c41c000</BaseAddress>
<Size>462848</Size>
<Path>C:\Windows\system32\drivers\Wdf01000.sys</Path>
<Version>1.9.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel Mode Driver Framework Runtime</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c49b000</BaseAddress>
<Size>294912</Size>
<Path>C:\Windows\system32\drivers\ACPI.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ACPI Driver for NT</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c4ec000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\drivers\msisadrv.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ISA Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c51e000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\drivers\vdrvroot.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Virtual Drive Root Enumerator</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c53a000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\drivers\compbatt.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Composite Battery Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c54d000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\drivers\volmgr.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Volume Manager Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c5a8000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\drivers\pciide.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Generic PCI IDE Bus Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c5bd000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\drivers\mountmgr.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Mount Point Manager</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c5dc000</BaseAddress>
<Size>143360</Size>
<Path>C:\Windows\system32\drivers\ataport.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ATAPI Driver Extension</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c748000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\System32\Drivers\msrpc.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel Remote Procedure Call Provider</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c786000</BaseAddress>
<Size>380928</Size>
<Path>C:\Windows\System32\Drivers\cng.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel Cryptography, Next Generation</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c7f1000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\Drivers\Fs_Rec.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>File System Recognizer Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c800000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\Drivers\aswRvrt.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c838000</BaseAddress>
<Size>749568</Size>
<Path>C:\Windows\system32\drivers\ndis.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NDIS 6.20 driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c92d000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\System32\Drivers\ksecpkg.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel Security Support Provider Interface Packages</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c962000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\drivers\hwpolicy.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Hardware Policy Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c99c000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\drivers\disk.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PnP Disk Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8c9d2000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\Drivers\aswVmm.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8cb51000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\System32\drivers\fwpkclnt.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec Kernel-Mode API</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8cb8b000</BaseAddress>
<Size>258048</Size>
<Path>C:\Windows\system32\drivers\volsnap.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Volume Shadow Copy Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x8cbd2000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\System32\drivers\rdyboost.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ReadyBoost Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9041a000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\DRIVERS\lltdio.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Link-Layer Topology Mapper I/O Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x90437000</BaseAddress>
<Size>782336</Size>
<Path>C:\Windows\System32\Drivers\aswSnx.SYS</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Virtualization Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x904ff000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\Drivers\Null.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NULL Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9050d000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\drivers\vga.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>VGA/Super VGA Video Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9053a000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\drivers\watchdog.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Watchdog Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9054f000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\drivers\rdpencdd.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RDP Encoder Miniport</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9055f000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\Drivers\Msfs.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Mailslot driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x90578000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\DRIVERS\tdx.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TDI Translation Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9059b000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\Drivers\aswTdi.SYS</Path>
<Version>8.0.1506.399 built by: WinDDK</Version>
<Company>AVAST Software</Company>
<Description>avast! TDI Filter Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x905be000</BaseAddress>
<Size>212992</Size>
<Path>C:\Windows\system32\DRIVERS\ks.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel CSA Library</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92071000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\System32\Drivers\dfsc.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DFS Namespace Client Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92097000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\System32\Drivers\aswSP.SYS</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! self protection module</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92110000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DRIVERS\intelppm.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Processor Device Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x921d9000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\DRIVERS\ndiswan.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>MS PPP Framing Driver (Strong Encryption)</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92217000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DRIVERS\umbus.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User-Mode Bus Enumerator</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9222d000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\system32\drivers\afd.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Ancillary Function Driver for WinSock</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92297000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\System32\DRIVERS\netbt.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>MBT Transport driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x922d0000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\DRIVERS\pacer.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Packet Scheduler</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92300000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DRIVERS\netbios.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NetBIOS interface driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92328000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\DRIVERS\wanarp.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>MS Remote Access and Routing ARP Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9234c000</BaseAddress>
<Size>266240</Size>
<Path>C:\Windows\system32\DRIVERS\rdbss.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Redirected Drive Buffering SubSystem Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92397000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\DRIVERS\mssmbios.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>System Management BIOS Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x923ad000</BaseAddress>
<Size>307200</Size>
<Path>C:\Windows\system32\DRIVERS\USBPORT.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>USB 1.1 &amp; 2.0 Port Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92854000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\DRIVERS\ndisuio.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NDIS User mode I/O driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92877000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\DRIVERS\RtNdPt60.sys</Path>
<Version>6.0.0717.2009 built by: WinDDK</Version>
<Company>Realtek                                            </Company>
<Description>Realtek NDIS Protocol Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92908000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\DRIVERS\bowser.sys</Path>
<Version>6.1.7601.17565 (win7sp1_gdr.110222-1630)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Lan Manager Datagram Receiver Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92933000</BaseAddress>
<Size>143360</Size>
<Path>C:\Windows\system32\DRIVERS\mrxsmb.sys</Path>
<Version>6.1.7601.17605 (win7sp1_gdr.110426-1503)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT SMB Minirdr</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x92991000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\DRIVERS\mrxsmb20.sys</Path>
<Version>6.1.7601.17605 (win7sp1_gdr.110426-1503)</Version>
<Company>Microsoft Corporation</Company>
<Description>Longhorn SMB 2.0 Redirector</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x929b3000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\drivers\cpuz135_x32.sys</Path>
<Version>6.1.7600.16385 built by: WinDDK</Version>
<Company>CPUID</Company>
<Description>CPUID Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x93372000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\drivers\dxgmms1.sys</Path>
<Version>6.1.7601.17554 (win7sp1_gdr.110202-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Graphics MMS</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x933b6000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\DRIVERS\usbehci.sys</Path>
<Version>6.1.7601.17586 (win7sp1_gdr.110324-1501)</Version>
<Company>Microsoft Corporation</Company>
<Description>EHCI eUSB Miniport Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x933e4000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\DRIVERS\raspppoe.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RAS PPPoE mini-port/call-manager driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x97e00000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\DRIVERS\rasl2tp.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RAS L2TP mini-port/call-manager driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x97e23000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\DRIVERS\rdpbus.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft RDP Bus Device driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x97f80000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\DRIVERS\vwifibus.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Virtual WiFi Bus Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x97f94000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\DRIVERS\parport.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Parallel Port Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x97fc4000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\DRIVERS\kbdclass.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Keyboard Class Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x97fde000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DRIVERS\AgileVpn.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RAS Agile Vpn Miniport Call Manager</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x97ffd000</BaseAddress>
<Size>8192</Size>
<Path>C:\Windows\system32\DRIVERS\swenum.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Plug and Play Software Device Enumerator</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9804a000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\System32\Drivers\NDProxy.SYS</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>NDIS Proxy</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x980ab000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\drivers\portcls.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Port Class (Class Driver for Port/Miniport Devices)</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x980f3000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\drivers\Dxapi.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX API Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9810a000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\Drivers\dump_dumpata.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x9811e000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\System32\Drivers\dump_dumpfve.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x98146000</BaseAddress>
<Size>8192</Size>
<Path>C:\Windows\system32\DRIVERS\USBD.SYS</Path>
<Version>6.1.7601.17586 (win7sp1_gdr.110324-1501)</Version>
<Company>Microsoft Corporation</Company>
<Description>Universal Serial Bus Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x98176000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\drivers\BdaSup.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft BDA Driver Support Library</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x98184000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\DRIVERS\hidusb.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>USB Miniport Driver for Input Devices</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x981a2000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\DRIVERS\HIDPARSE.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Hid Parsing Library</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x981b4000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\drivers\luafv.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LUA File Virtualization Filter Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x981f1000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\Drivers\aswFsBlk.SYS</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! File System Access Blocking Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x99a00000</BaseAddress>
<Size>122880</Size>
<Path>C:\Windows\System32\cdd.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Canonical Display Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x99b70000</BaseAddress>
<Size>2416640</Size>
<Path>C:\Windows\System32\win32k.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Win32 Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0x99dd0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\TSDDD.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Framebuffer Display Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0xa1ac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\Drivers\secdrv.SYS</Path>
<Version>4.03.086</Version>
<Company>Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.</Company>
<Description>Macrovision SECURITY Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0xa1aeb000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\drivers\tcpipreg.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TCP/IP Registry Compatibility Driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0xa1b48000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\System32\DRIVERS\srv.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0xa1b9d000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\Drivers\GVTDrv.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0xaa285000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\DRIVERS\asyncmac.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MS Remote Access serial network driver</Description>
</module>
<module>
<Timestamp>130411457981113578</Timestamp>
<BaseAddress>0xaa296000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\Drivers\PROCMON23.SYS</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>9</ProcessIndex>
<ProcessId>0</ProcessId>
<ParentProcessId>0</ParentProcessId>
<ParentProcessIndex>9</ParentProcessIndex>
<AuthenticationId>00000000:00000000</AuthenticationId>
<CreateTime>130411321285000000</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>4294967295</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity></Integrity>
<Owner></Owner>
<ProcessName>Idle</ProcessName>
<ImagePath>Idle</ImagePath>
<CommandLine></CommandLine>
<CompanyName></CompanyName>
<Version></Version>
<Description></Description>
<modulelist>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x90000</BaseAddress>
<Size>2547712</Size>
<Path>F:\Procmon.exe</Path>
<Version>3.10</Version>
<Company>Sysinternals - www.sysinternals.com</Company>
<Description>Process Monitor</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x6f950000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\CSCDLL.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Temporary Shim</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x6f960000</BaseAddress>
<Size>434176</Size>
<Path>C:\Windows\System32\cscui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Side Caching UI</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x6f9d0000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\system32\EhStorShell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage Shell Extension DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x6ffd0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashShell.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Shell Extension</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x70c70000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\napinsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>E-mail Naming Shim Provider</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x719c0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\FLTLIB.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Filter Library</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\NLAapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\System32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981254986</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>10</ProcessIndex>
<ProcessId>4088</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411322162691518</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>SearchIndexer.exe</ProcessName>
<ImagePath>C:\Windows\system32\SearchIndexer.exe</ImagePath>
<CommandLine>C:\Windows\system32\SearchIndexer.exe /Embedding</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Microsoft Windows Search Indexer</Description>
<modulelist>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x350000</BaseAddress>
<Size>434176</Size>
<Path>C:\Windows\system32\SearchIndexer.exe</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Search Indexer</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x6b700000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\system32\en-us\tQuery.dll.mui</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>tquery.dll</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x6b740000</BaseAddress>
<Size>1716224</Size>
<Path>C:\Windows\system32\ESENT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Extensible Storage Engine for Microsoft(R) Windows(R)</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x6b8f0000</BaseAddress>
<Size>1560576</Size>
<Path>C:\Windows\system32\TQUERY.DLL</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>tquery.dll</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x6ba70000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\mssprxy.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Search Proxy</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x6ba80000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\Msidle.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Idle Monitor</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x6ba90000</BaseAddress>
<Size>1413120</Size>
<Path>C:\Windows\system32\MSSRCH.DLL</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>mssrch.dll</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x6f7b0000</BaseAddress>
<Size>1138688</Size>
<Path>C:\Windows\system32\VSSAPI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x706b0000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\VssTrace.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Service Tracing Library</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x740d0000</BaseAddress>
<Size>290816</Size>
<Path>C:\Windows\system32\es.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\propsys.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981120794</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>11</ProcessIndex>
<ProcessId>356</ProcessId>
<ParentProcessId>4</ParentProcessId>
<ParentProcessIndex>8</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321373624138</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>smss.exe</ProcessName>
<ImagePath>C:\Windows\System32\smss.exe</ImagePath>
<CommandLine>\SystemRoot\System32\smss.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Session Manager</Description>
<modulelist>
<module>
<Timestamp>130411457981255126</Timestamp>
<BaseAddress>0x47a00000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\System32\smss.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Session Manager</Description>
</module>
<module>
<Timestamp>130411457981255126</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>12</ProcessIndex>
<ProcessId>468</ProcessId>
<ParentProcessId>440</ParentProcessId>
<ParentProcessIndex>13</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321420268220</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>csrss.exe</ProcessName>
<ImagePath>C:\Windows\system32\csrss.exe</ImagePath>
<CommandLine>%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Client Server Runtime Process</Description>
<modulelist>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x4a1e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\csrss.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Server Runtime Process</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\sxs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x75ec0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\sxssrv.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SxS Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x75ed0000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\winsrv.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x75f00000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\basesrv.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x75f10000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\CSRSRV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Server Runtime Process</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\SYSTEM32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255193</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>14</ProcessIndex>
<ProcessId>552</ProcessId>
<ParentProcessId>440</ParentProcessId>
<ParentProcessIndex>13</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321451624275</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>wininit.exe</ProcessName>
<ImagePath>C:\Windows\system32\wininit.exe</ImagePath>
<CommandLine>wininit.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Start-Up Application</Description>
<modulelist>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x290000</BaseAddress>
<Size>106496</Size>
<Path>C:\Windows\system32\wininit.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Start-Up Application</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255258</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>15</ProcessIndex>
<ProcessId>560</ProcessId>
<ParentProcessId>544</ParentProcessId>
<ParentProcessIndex>16</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321451624275</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>csrss.exe</ProcessName>
<ImagePath>C:\Windows\system32\csrss.exe</ImagePath>
<CommandLine>%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Client Server Runtime Process</Description>
<modulelist>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x4a1e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\csrss.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Server Runtime Process</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\sxs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x75ec0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\sxssrv.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SxS Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x75ed0000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\winsrv.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x75f00000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\basesrv.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x75f10000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\CSRSRV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Server Runtime Process</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\SYSTEM32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255312</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>17</ProcessIndex>
<ProcessId>632</ProcessId>
<ParentProcessId>552</ParentProcessId>
<ParentProcessIndex>14</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321452560276</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>lsass.exe</ProcessName>
<ImagePath>C:\Windows\system32\lsass.exe</ImagePath>
<CommandLine>C:\Windows\system32\lsass.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Local Security Authority Process</Description>
<modulelist>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0xf90000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\lsass.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Local Security Authority Process</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x72930000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\keyiso.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>CNG Key Isolation Service</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x733a0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\dssenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75390000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\system32\scecli.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Configuration Editor Client Engine</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75400000</BaseAddress>
<Size>212992</Size>
<Path>C:\Windows\system32\pku2u.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Pku2u Security Package</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75440000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\tspkg.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Service Security Package</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75470000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\efslsaext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LSA extension for EFS</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x754c0000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\wdigest.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Digest Access</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x754f0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\schannel.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TLS / SSL Security Provider</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75530000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\logoncli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Logon Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x755b0000</BaseAddress>
<Size>573440</Size>
<Path>C:\Windows\system32\netlogon.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Logon Services DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75640000</BaseAddress>
<Size>270336</Size>
<Path>C:\Windows\system32\msv1_0.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Authentication Package v1.0</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75700000</BaseAddress>
<Size>557056</Size>
<Path>C:\Windows\system32\kerberos.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kerberos Security Package</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75790000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\negoexts.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NegoExtender Security Package</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x757b0000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\netjoin.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Domain Join DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x757e0000</BaseAddress>
<Size>8192</Size>
<Path>C:\Windows\system32\msprivs.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Privilege Translations</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75880000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\cngaudit.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Next Generation audit library</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>C:\Windows\system32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75940000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\cryptdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptography Manager</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75960000</BaseAddress>
<Size>569344</Size>
<Path>C:\Windows\system32\SAMSRV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75d20000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\SspiSrv.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>LSA SSPI RPC interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255425</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>18</ProcessIndex>
<ProcessId>644</ProcessId>
<ParentProcessId>552</ParentProcessId>
<ParentProcessIndex>14</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321452716277</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>lsm.exe</ProcessName>
<ImagePath>C:\Windows\system32\lsm.exe</ImagePath>
<CommandLine>C:\Windows\system32\lsm.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Local Session Manager Service</Description>
<modulelist>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0xcd0000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\lsm.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Local Session Manager Service</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x75b90000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\WMsgAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WinLogon IPC Client</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x75ba0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\SYSNTFY.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Notifications Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255479</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>19</ProcessIndex>
<ProcessId>760</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321454744280</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k DcomLaunch</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411458363200460</Timestamp>
<BaseAddress>0x2d0000</BaseAddress>
<Size>20480</Size>
<Path>C:\WINDOWS\SYSTEM32\dllhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM Surrogate</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x74280000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\wbem\wmiutils.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\FastProx.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x750d0000</BaseAddress>
<Size>143360</Size>
<Path>C:\Windows\system32\wbem\wmidcprv.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75a80000</BaseAddress>
<Size>389120</Size>
<Path>c:\windows\system32\rpcss.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Distributed COM Services</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75b40000</BaseAddress>
<Size>299008</Size>
<Path>c:\windows\system32\umpnpmgr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User-mode Plug-and-Play Service</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\pcwum.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>c:\windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75bd0000</BaseAddress>
<Size>86016</Size>
<Path>c:\windows\system32\SPINF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPINF</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>c:\windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255536</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>20</ProcessIndex>
<ProcessId>880</ProcessId>
<ParentProcessId>544</ParentProcessId>
<ParentProcessIndex>16</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321455836282</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>winlogon.exe</ProcessName>
<ImagePath>C:\Windows\system32\winlogon.exe</ImagePath>
<CommandLine>winlogon.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Description>Windows Logon Application</Description>
<modulelist>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x430000</BaseAddress>
<Size>294912</Size>
<Path>C:\Windows\system32\winlogon.exe</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Logon Application</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x73e00000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\UXINIT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows User Experience Session Initialization Dll</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x757b0000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\netjoin.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Domain Join DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255592</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>21</ProcessIndex>
<ProcessId>908</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411321456304283</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k RPCSS</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75a70000</BaseAddress>
<Size>57344</Size>
<Path>c:\windows\system32\rpcepmap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RPC Endpoint Mapper</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75a80000</BaseAddress>
<Size>389120</Size>
<Path>c:\windows\system32\rpcss.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Distributed COM Services</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255649</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>22</ProcessIndex>
<ProcessId>972</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321456460283</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>atiesrxx.exe</ProcessName>
<ImagePath>C:\Windows\system32\atiesrxx.exe</ImagePath>
<CommandLine>C:\Windows\system32\atiesrxx.exe</CommandLine>
<CompanyName>AMD</CompanyName>
<Version>6.14.11.1110</Version>
<Description>AMD External Events Service Module</Description>
<modulelist>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\atiesrxx.exe</Path>
<Version>6.14.11.1110</Version>
<Company>AMD</Company>
<Description>AMD External Events Service Module</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255705</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>23</ProcessIndex>
<ProcessId>1056</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130411321456928284</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\System32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457992411801</Timestamp>
<BaseAddress>0xa20000</BaseAddress>
<Size>212992</Size>
<Path>C:\Windows\System32\drivers\fltmgr.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Filesystem Filter Manager</Description>
</module>
<module>
<Timestamp>130411458291467839</Timestamp>
<BaseAddress>0x17890000</BaseAddress>
<Size>700416</Size>
<Path>C:\Windows\System32\ci.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Code Integrity Module</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x67580000</BaseAddress>
<Size>581632</Size>
<Path>C:\Windows\system32\wuapi.dll</Path>
<Version>7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Update Client API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x67760000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\Cabinet.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Cabinet File API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>c:\windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x68e00000</BaseAddress>
<Size>1417216</Size>
<Path>C:\Windows\system32\WMALFXGFXDSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SysFx DSP</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x72840000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\System32\dhcpcore6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x72980000</BaseAddress>
<Size>24576</Size>
<Path>c:\windows\system32\nrpsrv.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Name Resolution Proxy (NRP) RPC interface</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>c:\windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x729d0000</BaseAddress>
<Size>32768</Size>
<Path>c:\windows\system32\lmhsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>TCPIP NetBios Transport Services DLL</Description>
</module>
<module>
<Timestamp>130411458511832267</Timestamp>
<BaseAddress>0x73780000</BaseAddress>
<Size>28672</Size>
<Path>C:\WINDOWS\SYSTEM32\aeevts.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Experience Event Resources</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x73820000</BaseAddress>
<Size>81920</Size>
<Path>c:\windows\system32\wscsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center Service</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x73da0000</BaseAddress>
<Size>364544</Size>
<Path>C:\Windows\System32\mfplat.DLL</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Platform DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\System32\audioses.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\System32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74420000</BaseAddress>
<Size>466944</Size>
<Path>C:\Windows\System32\audiokse.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Ks Endpoint</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74790000</BaseAddress>
<Size>499712</Size>
<Path>c:\windows\system32\audiosrv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Audio Service</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74910000</BaseAddress>
<Size>1097728</Size>
<Path>c:\windows\system32\wevtsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Event Logging Service</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>c:\windows\system32\MMDevAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>c:\windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\System32\firewallapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>c:\windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>c:\windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\system32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255765</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>24</ProcessIndex>
<ProcessId>1088</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321457084284</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\System32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x6b630000</BaseAddress>
<Size>790528</Size>
<Path>C:\Windows\System32\RASDLG.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Common Dialog API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x6c590000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\cscobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>In-proc COM object used by clients of CSC API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x70ef0000</BaseAddress>
<Size>2510848</Size>
<Path>C:\Windows\System32\netshell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connections Shell</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72020000</BaseAddress>
<Size>421888</Size>
<Path>C:\Windows\system32\netcfgx.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Configuration Objects</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72510000</BaseAddress>
<Size>143360</Size>
<Path>c:\windows\system32\WinSCard.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Smart Card API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>c:\windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72550000</BaseAddress>
<Size>69632</Size>
<Path>c:\windows\system32\l2gpstore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Policy Storage dll</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72590000</BaseAddress>
<Size>192512</Size>
<Path>c:\windows\system32\eappcfg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eap Peer Config</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x725c0000</BaseAddress>
<Size>69632</Size>
<Path>c:\windows\system32\eappprxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost Peer Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x725e0000</BaseAddress>
<Size>212992</Size>
<Path>c:\windows\system32\OneX.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IEEE 802.1X supplicant library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72620000</BaseAddress>
<Size>430080</Size>
<Path>c:\windows\system32\WLANSEC.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 MSM Security Module DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72690000</BaseAddress>
<Size>442368</Size>
<Path>c:\windows\system32\WLANMSM.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 MSM DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72700000</BaseAddress>
<Size>839680</Size>
<Path>c:\windows\system32\wlansvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Service DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>c:\windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>c:\windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x73430000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\MPRAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MP Router Administration DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x734f0000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\portabledeviceconnectapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Portable Device Connection API Components</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x73550000</BaseAddress>
<Size>561152</Size>
<Path>C:\Windows\system32\PortableDeviceApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device API Components</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x73840000</BaseAddress>
<Size>290816</Size>
<Path>c:\windows\system32\netman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connections Manager</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x73c20000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\hnetcfg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Home Networking Configuration Manager</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74020000</BaseAddress>
<Size>176128</Size>
<Path>c:\windows\system32\WUDFPlatform.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Driver Foundation - User-mode Platform Library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74050000</BaseAddress>
<Size>81920</Size>
<Path>c:\windows\system32\wudfsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Driver Foundation - User-mode Driver Framework Service</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74070000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\uxsms.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft User Experience Session Management Service</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74120000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\System32\mstask.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74160000</BaseAddress>
<Size>512000</Size>
<Path>C:\Windows\system32\taskschd.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler COM API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74230000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\System32\PeerDist.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>BranchCache Client Library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74380000</BaseAddress>
<Size>557056</Size>
<Path>c:\windows\system32\cscsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>CSC Service DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\System32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x744d0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\rtutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Routing Utilities</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\System32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\System32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74790000</BaseAddress>
<Size>499712</Size>
<Path>c:\windows\system32\audiosrv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Audio Service</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>c:\windows\system32\MMDevAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>c:\windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x751b0000</BaseAddress>
<Size>1171456</Size>
<Path>c:\windows\system32\sysmain.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Superfetch Service Host</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75700000</BaseAddress>
<Size>557056</Size>
<Path>C:\Windows\system32\kerberos.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kerberos Security Package</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>c:\windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>c:\windows\system32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75940000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\System32\cryptdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptography Manager</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x759f0000</BaseAddress>
<Size>86016</Size>
<Path>c:\windows\system32\trkwks.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Distributed Link Tracking Client</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>c:\windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>c:\windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75ba0000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\SYSNTFY.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Notifications Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\devrtl.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255821</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>25</ProcessIndex>
<ProcessId>1136</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321457240285</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k netsvcs</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411458363483990</Timestamp>
<BaseAddress>0x2050000</BaseAddress>
<Size>761856</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x67440000</BaseAddress>
<Size>1257472</Size>
<Path>C:\Windows\System32\msxml3.dll</Path>
<Version>8.110.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 3.0 SP11</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x67750000</BaseAddress>
<Size>49152</Size>
<Path>c:\windows\system32\mspatcha.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft File Patch Application API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x67760000</BaseAddress>
<Size>86016</Size>
<Path>c:\windows\system32\Cabinet.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Cabinet File API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x67780000</BaseAddress>
<Size>1941504</Size>
<Path>c:\windows\system32\wuaueng.dll</Path>
<Version>7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Update Agent</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x67c60000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\wbem\ncprov.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Non-COM WMI Event Provision APIs</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x6aff0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\NCI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>CoInstaller: NET</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x6b740000</BaseAddress>
<Size>1716224</Size>
<Path>c:\windows\system32\ESENT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Extensible Storage Engine for Microsoft(R) Windows(R)</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x6d740000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\SPFILEQ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPFILEQ</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\System32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x6f7b0000</BaseAddress>
<Size>1138688</Size>
<Path>C:\Windows\system32\VSSAPI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x6fad0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\SSDPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x706b0000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\VssTrace.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Service Tracing Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>c:\windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x70be0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\cryptnet.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto Network Related API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71630000</BaseAddress>
<Size>315392</Size>
<Path>C:\Windows\system32\taskcomp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler Backward Compatibility Plug-in</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71850000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\ktmw32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows KTM Win32 Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71860000</BaseAddress>
<Size>761856</Size>
<Path>c:\windows\system32\schedsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler Service</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71cf0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\wiarpc.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Acquisition RPC client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71d00000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\FVECERTS.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>BitLocker Certificates Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71d10000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\tbs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>TBS</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71d20000</BaseAddress>
<Size>274432</Size>
<Path>C:\Windows\system32\FVEAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows BitLocker Drive Encryption API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71dc0000</BaseAddress>
<Size>335872</Size>
<Path>c:\windows\system32\shsvcs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Services Dll</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x727d0000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\umb.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Mode Bus Driver Interface Dll</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x727e0000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\eapphost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost Peer service</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x72820000</BaseAddress>
<Size>106496</Size>
<Path>c:\windows\system32\eapsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost service</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>c:\windows\system32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x733a0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\dssenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73490000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\upnp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>UPnP Control Point API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x734d0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\bitsigd.dll</Path>
<Version>7.5.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Background Intelligent Transfer Service IGD Support</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73510000</BaseAddress>
<Size>61440</Size>
<Path>c:\windows\system32\appinfo.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Information Service</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73530000</BaseAddress>
<Size>32768</Size>
<Path>c:\windows\system32\bitsperf.dll</Path>
<Version>7.5.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Perfmon Counter Access</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73630000</BaseAddress>
<Size>397312</Size>
<Path>C:\Windows\system32\wer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73790000</BaseAddress>
<Size>73728</Size>
<Path>c:\windows\system32\mmcss.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Class Scheduler Service</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x738b0000</BaseAddress>
<Size>598016</Size>
<Path>c:\windows\system32\qmgr.dll</Path>
<Version>7.5.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Background Intelligent Transfer Service</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73ae0000</BaseAddress>
<Size>352256</Size>
<Path>C:\Windows\system32\wbem\wbemess.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73b40000</BaseAddress>
<Size>528384</Size>
<Path>C:\Windows\system32\wbem\wmiprvsd.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73bd0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\wbem\repdrvfs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Repository Driver</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73c70000</BaseAddress>
<Size>794624</Size>
<Path>C:\Windows\system32\wbem\wbemcore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Management Instrumentation</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x73f00000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\tschannel.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler Proxy</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74080000</BaseAddress>
<Size>61440</Size>
<Path>c:\windows\system32\sens.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>System Event Notification Service (SENS)</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>c:\windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74220000</BaseAddress>
<Size>49152</Size>
<Path>c:\windows\system32\themeservice.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Theme Service Dll</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>c:\windows\system32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74280000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\wbem\wmiutils.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x742e0000</BaseAddress>
<Size>602112</Size>
<Path>c:\windows\system32\gpsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x744d0000</BaseAddress>
<Size>53248</Size>
<Path>c:\windows\system32\rtutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Routing Utilities</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RasApi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74560000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\NCObjAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74570000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\wbem\esscli.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x745c0000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\CLUSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cluster API Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74690000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\RESUTILS.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Cluster Resource Utility DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x746b0000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\browser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Computer Browser Service DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x746d0000</BaseAddress>
<Size>180224</Size>
<Path>c:\windows\system32\srvsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74700000</BaseAddress>
<Size>204800</Size>
<Path>c:\windows\system32\WDSCORE.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Panther Engine Module</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74760000</BaseAddress>
<Size>176128</Size>
<Path>c:\windows\system32\profsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ProfSvc</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>c:\windows\system32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74ab0000</BaseAddress>
<Size>208896</Size>
<Path>c:\windows\system32\sqmapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>SQM Client</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\FastProx.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75100000</BaseAddress>
<Size>512000</Size>
<Path>c:\windows\system32\iphlpsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Service that offers IPv6 connectivity over an IPv4 network.</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75180000</BaseAddress>
<Size>176128</Size>
<Path>c:\windows\system32\wbem\wmisvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>c:\windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75350000</BaseAddress>
<Size>180224</Size>
<Path>c:\windows\system32\UBPM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unified Background Process Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x754f0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\schannel.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TLS / SSL Security Provider</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75530000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\LOGONCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Logon Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x757b0000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\netjoin.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Domain Join DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x757f0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\SSCORE.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Core DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>c:\windows\system32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75940000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\cryptdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptography Manager</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>c:\windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>c:\windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75b90000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\WMsgAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WinLogon IPC Client</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75ba0000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\SYSNTFY.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Notifications Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\devrtl.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75bd0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\SPINF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPINF</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>c:\windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255881</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>26</ProcessIndex>
<ProcessId>1288</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130411321459580289</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k LocalService</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x67ef0000</BaseAddress>
<Size>1126400</Size>
<Path>C:\Windows\system32\sppcext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Protection Platform Client Extension Dll</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x68d70000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\TAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Windows(TM) Telephony API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x68db0000</BaseAddress>
<Size>208896</Size>
<Path>C:\Windows\system32\sppcomapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Library</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x6a5d0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\slwga.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing WGA API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x6a640000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\sppc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>c:\windows\system32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x6fd90000</BaseAddress>
<Size>2359296</Size>
<Path>C:\Windows\system32\msi.dll</Path>
<Version>5.0.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Installer</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\sfc_os.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x70c70000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\napinsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>E-mail Naming Shim Provider</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\winhttp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x72510000</BaseAddress>
<Size>143360</Size>
<Path>C:\Windows\system32\WinSCard.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Smart Card API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x729a0000</BaseAddress>
<Size>32768</Size>
<Path>c:\windows\system32\nsisvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Interface RPC server</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\Windows\system32\CRYPTUI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x735e0000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\AEPIC.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Experience Program Cache</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x73630000</BaseAddress>
<Size>397312</Size>
<Path>C:\Windows\system32\wer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x736b0000</BaseAddress>
<Size>589824</Size>
<Path>C:\Windows\system32\perftrack.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Performance PerfTrack</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x73890000</BaseAddress>
<Size>86016</Size>
<Path>c:\windows\system32\wdi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Diagnostic Infrastructure</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x740d0000</BaseAddress>
<Size>290816</Size>
<Path>c:\windows\system32\es.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>c:\windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>c:\windows\system32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\System32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>c:\windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255937</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>27</ProcessIndex>
<ProcessId>1400</ProcessId>
<ParentProcessId>972</ParentProcessId>
<ParentProcessIndex>22</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321460204290</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>atieclxx.exe</ProcessName>
<ImagePath>C:\Windows\system32\atieclxx.exe</ImagePath>
<CommandLine>atieclxx</CommandLine>
<CompanyName>AMD</CompanyName>
<Version>6.14.11.1110</Version>
<Description>AMD External Events Client Module</Description>
<modulelist>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>425984</Size>
<Path>C:\Windows\system32\atieclxx.exe</Path>
<Version>6.14.11.1110</Version>
<Company>AMD</Company>
<Description>AMD External Events Client Module</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x73d40000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\atiadlxx.dll</Path>
<Version>6.14.10.1081</Version>
<Company>Advanced Micro Devices, Inc.</Company>
<Description>ADL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981255996</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>28</ProcessIndex>
<ProcessId>1544</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411321461752302</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k NetworkService</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x6b740000</BaseAddress>
<Size>1716224</Size>
<Path>C:\Windows\system32\ESENT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Extensible Storage Engine for Microsoft(R) Windows(R)</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x6f7b0000</BaseAddress>
<Size>1138688</Size>
<Path>C:\Windows\system32\VSSAPI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x6fad0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\ssdpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x6fae0000</BaseAddress>
<Size>163840</Size>
<Path>c:\windows\system32\ncsi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connectivity Status Indicator</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x6fb10000</BaseAddress>
<Size>253952</Size>
<Path>c:\windows\system32\nlasvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x706c0000</BaseAddress>
<Size>147456</Size>
<Path>c:\windows\system32\cryptsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Services</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x70750000</BaseAddress>
<Size>94208</Size>
<Path>c:\windows\system32\wkssvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>c:\windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>c:\windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\Fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\iphlpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x737f0000</BaseAddress>
<Size>143360</Size>
<Path>c:\windows\system32\dnsrslvr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Caching Resolver Service</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x73f10000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\dnsext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS extension DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x740d0000</BaseAddress>
<Size>290816</Size>
<Path>C:\Windows\system32\es.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>c:\windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x757b0000</BaseAddress>
<Size>176128</Size>
<Path>c:\windows\system32\netjoin.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Domain Join DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>c:\windows\system32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256050</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>29</ProcessIndex>
<ProcessId>1624</ProcessId>
<ParentProcessId>1088</ParentProcessId>
<ParentProcessIndex>24</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321474152320</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>WLANExt.exe</ProcessName>
<ImagePath>C:\Windows\system32\WLANExt.exe</ImagePath>
<CommandLine>C:\Windows\system32\WLANExt.exe 22197176</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Wireless LAN 802.11 Extensibility Framework</Description>
<modulelist>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x6c0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\WLANExt.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Extensibility Framework</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>626688</Size>
<Path>C:\Windows\system32\Rtlihvs.dll</Path>
<Version>600, 1002, 508, 2008</Version>
<Company>Realtek Semiconductor Corp. </Company>
<Description>Realtek CCX SDK IHV Service</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\Wlanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256110</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>30</ProcessIndex>
<ProcessId>1632</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321474552320</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>AvastSvc.exe</ProcessName>
<ImagePath>C:\Program Files\AVAST Software\Avast\AvastSvc.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\AVAST Software\Avast\AvastSvc.exe&quot;</CommandLine>
<CompanyName>AVAST Software</CompanyName>
<Version>8.0.1506.399</Version>
<Description>avast! Service</Description>
<modulelist>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0xd0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Program Files\AVAST Software\Avast\AvastSvc.exe</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Service</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x6daa0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\wscproxystub.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center ISV Proxy Stub</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70190000</BaseAddress>
<Size>401408</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\swhealthex.dll</Path>
<Version>7.0.1506.284</Version>
<Company>AVAST Software</Company>
<Description>Software Health extension library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\mpr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70590000</BaseAddress>
<Size>933888</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswpatchmgt.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Software Health framework library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70bd0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\SensApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SENS Connectivity API DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70be0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\cryptnet.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto Network Related API</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70c00000</BaseAddress>
<Size>94208</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashWsFtr.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Web Shield Filter Module</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70c20000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\security.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70c80000</BaseAddress>
<Size>376832</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashWebSv.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Web Scanner</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70cf0000</BaseAddress>
<Size>1191936</Size>
<Path>C:\Program Files\AVAST Software\Avast\LIBEAY32.dll</Path>
<Version>1.0.1c</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70e20000</BaseAddress>
<Size>282624</Size>
<Path>C:\Program Files\AVAST Software\Avast\SSLEAY32.dll</Path>
<Version>1.0.1c</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70e70000</BaseAddress>
<Size>430080</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashMaiSv.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! e-Mail Scanner Service</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70ee0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\arPot.dll</Path>
<Version>7.0.1506.244</Version>
<Company>AVAST Software</Company>
<Description>ArPot usermode dll component</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x70ef0000</BaseAddress>
<Size>2510848</Size>
<Path>C:\Windows\system32\netshell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connections Shell</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71160000</BaseAddress>
<Size>118784</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResWS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! HTTP Scanner AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71180000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResStd.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Standard Shield  AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x711a0000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResP2P.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! P2P Shield AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x711c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResNS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Network Shield AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71200000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResMes.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Messenger scanner AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71220000</BaseAddress>
<Size>69632</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResMai.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! e-Mail Scanner AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71240000</BaseAddress>
<Size>36864</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResJs.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Script Blocking AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71250000</BaseAddress>
<Size>73728</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResBhv.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Behavior Shield AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x714a0000</BaseAddress>
<Size>434176</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\aswFiDb.dll</Path>
<Version>7.0.1506.263</Version>
<Company>AVAST Software</Company>
<Description>File information database access</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71510000</BaseAddress>
<Size>344064</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\aswRep.dll</Path>
<Version>7.0.1506.258</Version>
<Company>AVAST Software</Company>
<Description>Reputation services access</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71570000</BaseAddress>
<Size>159744</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\aswScan.dll</Path>
<Version>7.0.1506.270</Version>
<Company>AVAST Software</Company>
<Description>Low level antivirus engine</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x715a0000</BaseAddress>
<Size>425984</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\aswCmnBS.dll</Path>
<Version>7.0.1506.282</Version>
<Company>AVAST Software</Company>
<Description>Common functions</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71610000</BaseAddress>
<Size>126976</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\aswCmnOS.dll</Path>
<Version>7.0.1506.269</Version>
<Company>AVAST Software</Company>
<Description>Antivirus HW dependent library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71680000</BaseAddress>
<Size>348160</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\aswCmnIS.dll</Path>
<Version>7.0.1506.272</Version>
<Company>AVAST Software</Company>
<Description>Antivirus independent functions</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x716e0000</BaseAddress>
<Size>1351680</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\aswEngin.dll</Path>
<Version>7.0.1506.282</Version>
<Company>AVAST Software</Company>
<Description>High level antivirus engine</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71830000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\WSCAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center API</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71840000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\wscisvif.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center ISV API</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71920000</BaseAddress>
<Size>274432</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswStrm.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Streaming Update library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71970000</BaseAddress>
<Size>118784</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswDld.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>aswDld Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswIdle.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Idle Hook Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x719a0000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\AVAST Software\Avast\avastIP.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>aswDld Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x719c0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\FltLib.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Filter Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x719d0000</BaseAddress>
<Size>921600</Size>
<Path>C:\Program Files\AVAST Software\Avast\Aavm4h.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Asynchronous Virus Monitor (AAVM)</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71ac0000</BaseAddress>
<Size>151552</Size>
<Path>C:\Program Files\AVAST Software\Avast\AavmRpch.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! AAVM Remote Procedure Call Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71af0000</BaseAddress>
<Size>479232</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswSqLt.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! SQLite library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71b70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswLog.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Log library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71bc0000</BaseAddress>
<Size>163840</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashTask.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Task Handling Module</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71bf0000</BaseAddress>
<Size>688128</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswAux.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Auxiliary Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71ca0000</BaseAddress>
<Size>270336</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswProperty.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Property Storage library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71d70000</BaseAddress>
<Size>290816</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashServ.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! antivirus service</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x71ee0000</BaseAddress>
<Size>1183744</Size>
<Path>C:\Program Files\AVAST Software\Avast\dbghelp.dll</Path>
<Version>6.11.0001.404 (debuggers(dbg).090225-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x72010000</BaseAddress>
<Size>57344</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswEngLdr.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus engine loader</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\wlanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x720c0000</BaseAddress>
<Size>970752</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashBase.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Basic Functionality Module</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x721b0000</BaseAddress>
<Size>581632</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C++ Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x72240000</BaseAddress>
<Size>667648</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x722f0000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnIS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus independent functions</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x72330000</BaseAddress>
<Size>126976</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnOS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus HW dependent library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x72350000</BaseAddress>
<Size>389120</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnBS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Common functions</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x73360000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\qmgrprxy.dll</Path>
<Version>7.5.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Background Intelligent Transfer Service Proxy</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\SAMCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NetApi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x754f0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\schannel.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TLS / SSL Security Provider</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\Wtsapi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\system32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256177</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>31</ProcessIndex>
<ProcessId>1640</ProcessId>
<ParentProcessId>468</ParentProcessId>
<ParentProcessIndex>12</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321476452323</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>conhost.exe</ProcessName>
<ImagePath>C:\Windows\system32\conhost.exe</ImagePath>
<CommandLine>\??\C:\Windows\system32\conhost.exe &quot;-1787936648-796517604-2007917410-1354616604-320319752-230837961-8151588261916011241</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Console Window Host</Description>
<modulelist>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0xaa0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\conhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Console Window Host</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256236</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>32</ProcessIndex>
<ProcessId>1768</ProcessId>
<ParentProcessId>1088</ParentProcessId>
<ParentProcessIndex>24</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411321559934458</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Dwm.exe</ProcessName>
<ImagePath>C:\Windows\system32\Dwm.exe</ImagePath>
<CommandLine>&quot;C:\Windows\system32\Dwm.exe&quot;</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Desktop Window Manager</Description>
<modulelist>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x6a0000</BaseAddress>
<Size>106496</Size>
<Path>C:\Windows\system32\Dwm.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Desktop Window Manager</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x70200000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\dxgi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Graphics Infrastructure</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x70350000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\d3d10_1.dll</Path>
<Version>6.1.7601.17544 (win7sp1_gdr.110116-1505)</Version>
<Company>Microsoft Corporation</Company>
<Description>Direct3D 10.1 Runtime</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x70380000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\d3d10_1core.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Direct3D 10.1 Runtime</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x703f0000</BaseAddress>
<Size>1380352</Size>
<Path>C:\Windows\system32\dwmcore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DWM Core Library</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x70550000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\dwmredir.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager Redirection Component</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256296</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>33</ProcessIndex>
<ProcessId>1724</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411321560558459</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>1</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>taskhost.exe</ProcessName>
<ImagePath>C:\Windows\system32\taskhost.exe</ImagePath>
<CommandLine>&quot;taskhost.exe&quot;</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Tasks</Description>
<modulelist>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x410000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\taskhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Tasks</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x6e3d0000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\wdmaud.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winmm  audio system driver</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x6f670000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\midimap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MIDI Mapper</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\System32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x6fa80000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\msacm32.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sound Mapper</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x70000000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\PlaySndSrv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PlaySound Service</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x70290000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\MSUTB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSUTB Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x702c0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\MsCtfMonitor.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MsCtfMonitor DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x702d0000</BaseAddress>
<Size>495616</Size>
<Path>C:\Windows\System32\mscms.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Color Matching System DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x703d0000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\Dxva2.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Video Acceleration 2.0 DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x73140000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\dimsjob.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DIMS Job DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\MSACM32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x74160000</BaseAddress>
<Size>512000</Size>
<Path>C:\Windows\system32\taskschd.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler COM API</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\system32\MMDevAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256355</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>34</ProcessIndex>
<ProcessId>1716</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321696746698</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>spoolsv.exe</ProcessName>
<ImagePath>C:\Windows\System32\spoolsv.exe</ImagePath>
<CommandLine>C:\Windows\System32\spoolsv.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Spooler SubSystem App</Description>
<modulelist>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x480000</BaseAddress>
<Size>327680</Size>
<Path>C:\Windows\System32\spoolsv.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Spooler SubSystem App</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e150000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\System32\inetpp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Print Provider DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e180000</BaseAddress>
<Size>507904</Size>
<Path>C:\Windows\System32\win32spl.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Side Rendering Print Provider</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e200000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\spool\PRTPROCS\W32X86\winprint.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Print Processor DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e210000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\fdPnp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Pnp Provider Dll</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e220000</BaseAddress>
<Size>794624</Size>
<Path>C:\Windows\System32\webservices.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Web Services Runtime</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e2f0000</BaseAddress>
<Size>471040</Size>
<Path>C:\Windows\System32\wsdapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Services for Devices API DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e370000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\System32\WSDMon.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WSD Printer Port Monitor</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e3a0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wls0wndh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Session0 Viewer Window Hook DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e3b0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\usbmon.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Standard Dynamic Printing Port Monitor DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6e3c0000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\wsnmp32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft WinSNMP v2.0 Manager API</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6f3e0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\snmpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SNMP Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6f3f0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\System32\tcpmon.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Standard TCP/IP Port Monitor DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6f420000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\FXSMON.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft  Fax Print Monitor</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6f430000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\PrintIsolationProxy.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Print Sandbox COM Proxy Stub</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6f440000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\SPOOLSS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Spooler SubSystem DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x70840000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\FunDisc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Function Discovery Dll</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x70970000</BaseAddress>
<Size>782336</Size>
<Path>C:\Windows\System32\localspl.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Local Spooler DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\winspool.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x727d0000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\umb.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Mode Bus Driver Interface Dll</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\System32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\System32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\System32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\System32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75bd0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\System32\SPINF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPINF</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256417</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>35</ProcessIndex>
<ProcessId>1872</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130411321718742737</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\System32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x6fd00000</BaseAddress>
<Size>577536</Size>
<Path>c:\windows\system32\mpssvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Protection Service</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x70680000</BaseAddress>
<Size>151552</Size>
<Path>c:\windows\system32\dps.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WDI Diagnostic Policy Service</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x70740000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\wfapigp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall GPO Helper dll</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x70770000</BaseAddress>
<Size>516096</Size>
<Path>c:\windows\system32\bfe.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base Filtering Engine</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>c:\windows\system32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x73540000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\wdiasqmmodule.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Adaptive SQM WDI Plugin</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x73600000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\radardt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Resource Exhaustion Detector</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x73890000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\wdi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Diagnostic Infrastructure</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x74160000</BaseAddress>
<Size>512000</Size>
<Path>C:\Windows\system32\taskschd.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler COM API</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>c:\windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>c:\windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256476</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>36</ProcessIndex>
<ProcessId>2140</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321724982747</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>ACService.exe</ProcessName>
<ImagePath>C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe&quot;</CommandLine>
<CompanyName>ArcSoft Inc.</CompanyName>
<Version>1.1.0.47</Version>
<Description>ArcSoft Connect Service</Description>
<modulelist>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>110592</Size>
<Path>C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe</Path>
<Version>1.1.0.47</Version>
<Company>ArcSoft Inc.</Company>
<Description>ArcSoft Connect Service</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSApi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256533</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>37</ProcessIndex>
<ProcessId>2160</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321725450748</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>armsvc.exe</ProcessName>
<ImagePath>C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe&quot;</CommandLine>
<CompanyName>Adobe Systems Incorporated</CompanyName>
<Version>1.701.3.3014</Version>
<Description>Adobe Acrobat Update Service</Description>
<modulelist>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0xd0000</BaseAddress>
<Size>65536</Size>
<Path>C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe</Path>
<Version>1.701.3.3014</Version>
<Company>Adobe Systems Incorporated</Company>
<Description>Adobe Acrobat Update Service</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x72240000</BaseAddress>
<Size>667648</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256592</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>38</ProcessIndex>
<ProcessId>2188</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321728414754</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>RtlService.exe</ProcessName>
<ImagePath>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlService.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlService.exe&quot;</CommandLine>
<CompanyName>Realtek</CompanyName>
<Version>700, 1006, 416, 2010</Version>
<Description>RtlService MFC Application</Description>
<modulelist>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>40960</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlService.exe</Path>
<Version>700, 1006, 416, 2010</Version>
<Company>Realtek</Company>
<Description>RtlService MFC Application</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x6fb50000</BaseAddress>
<Size>573440</Size>
<Path>C:\Windows\system32\ODBC32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ODBC Driver Manager</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x6fbe0000</BaseAddress>
<Size>1163264</Size>
<Path>C:\Windows\system32\MFC42.DLL</Path>
<Version>6.06.8063.0</Version>
<Company>Microsoft Corporation</Company>
<Description>MFCDLL Shared Library - Retail Version</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x70700000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\odbcint.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ODBC Resources</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256649</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>39</ProcessIndex>
<ProcessId>2224</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321733250762</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>BCUService.exe</ProcessName>
<ImagePath>C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe&quot;</CommandLine>
<CompanyName>DeviceVM, Inc.</CompanyName>
<Version>1, 1, 7, 0</Version>
<Description>Browser Configuration Utility Auto-recovery Service</Description>
<modulelist>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe</Path>
<Version>1, 1, 7, 0</Version>
<Company>DeviceVM, Inc.</Company>
<Description>Browser Configuration Utility Auto-recovery Service</Description>
</module>
<module>
<Timestamp>130411459794867983</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\WINDOWS\SYSTEM32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411459794863205</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\WINDOWS\SYSTEM32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411459794886412</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\WINDOWS\SYSTEM32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411459794904823</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\WINDOWS\SYSTEM32\ntdsapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411459794899757</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\WINDOWS\SYSTEM32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256705</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>40</ProcessIndex>
<ProcessId>2268</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321736058767</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>des2svr.exe</ProcessName>
<ImagePath>C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe&quot;</CommandLine>
<CompanyName></CompanyName>
<Version></Version>
<Description></Description>
<modulelist>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>65536</Size>
<Path>C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>102400</Size>
<Path>C:\Program Files\GIGABYTE\EnergySaver2\ycc.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x734e0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\perfos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows System Performance Objects DLL</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256762</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>41</ProcessIndex>
<ProcessId>2332</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321742922779</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>RaRegistry.exe</ProcessName>
<ImagePath>C:\Program Files\Ralink\Common\RaRegistry.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Ralink\Common\RaRegistry.exe&quot;</CommandLine>
<CompanyName>Ralink Technology, Corp.</CompanyName>
<Version>1, 0, 0, 26</Version>
<Description>RalinkRegistryWriter</Description>
<modulelist>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>376832</Size>
<Path>C:\Program Files\Ralink\Common\RaRegistry.exe</Path>
<Version>1, 0, 0, 26</Version>
<Company>Ralink Technology, Corp.</Company>
<Description>RalinkRegistryWriter</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>552960</Size>
<Path>C:\Program Files\Ralink\Common\ICSDHCP.dll</Path>
<Version>1, 1, 2, 14</Version>
<Company>Ralink Technology, Inc.</Company>
<Description>ICSDHCP DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256821</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>42</ProcessIndex>
<ProcessId>2396</ProcessId>
<ParentProcessId>2188</ParentProcessId>
<ParentProcessIndex>38</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321760706810</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>RtWlan.exe</ProcessName>
<ImagePath>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtWlan.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtWlan.exe&quot; /H</CommandLine>
<CompanyName>ASUSTeK Computer Inc.</CompanyName>
<Version>1, 0, 0, 8</Version>
<Description></Description>
<modulelist>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>7585792</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtWlan.exe</Path>
<Version>1, 0, 0, 8</Version>
<Company>ASUSTeK Computer Inc.</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x2ac0000</BaseAddress>
<Size>241664</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlIhvOid.dll</Path>
<Version>1, 1015, 826, 2010</Version>
<Company>Realtek</Company>
<Description>IHV OID (for Vista)</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x2b20000</BaseAddress>
<Size>217088</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\IpLib.dll</Path>
<Version>600, 1001, 1231, 2008</Version>
<Company>Realtek</Company>
<Description>IpLib</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x2fa0000</BaseAddress>
<Size>1081344</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\LIBEAY32.dll</Path>
<Version>0.9.8b</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x3240000</BaseAddress>
<Size>364544</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\EnumDevLib.dll</Path>
<Version>700, 1034, 1209, 2009</Version>
<Company></Company>
<Description>EnumDevLib DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x32a0000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlICS.dll</Path>
<Version>600, 1008, 204, 2010</Version>
<Company>Realtek</Company>
<Description>RtlICS DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>630784</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlLib.dll</Path>
<Version>700, 1066, 1208, 2010</Version>
<Company>Realtek Semiconductor Corp.</Company>
<Description>RtlLib DLL(IHV)</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x6f6e0000</BaseAddress>
<Size>421888</Size>
<Path>C:\Windows\system32\wlanui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Wireless Profile UI</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x6faa0000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\wlanhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Client Side Helper API</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x6fb50000</BaseAddress>
<Size>573440</Size>
<Path>C:\Windows\system32\ODBC32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ODBC Driver Manager</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x6fbe0000</BaseAddress>
<Size>1163264</Size>
<Path>C:\Windows\system32\MFC42.DLL</Path>
<Version>6.06.8063.0</Version>
<Company>Microsoft Corporation</Company>
<Description>MFCDLL Shared Library - Retail Version</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x70700000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\odbcint.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ODBC Resources</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x70a30000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\oledlg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE User Interface Support</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\Wlanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x72590000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\eappcfg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eap Peer Config</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x725c0000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\eappprxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost Peer Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x725e0000</BaseAddress>
<Size>212992</Size>
<Path>C:\Windows\system32\OneX.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IEEE 802.1X supplicant library</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\iphlpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x74660000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\credui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Manager User Interface</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\Windows\system32\DUI70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x74be0000</BaseAddress>
<Size>1638400</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft GDI+</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256875</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>43</ProcessIndex>
<ProcessId>2796</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>19</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411322047435314</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>wmiprvse.exe</ProcessName>
<ImagePath>C:\Windows\system32\wbem\wmiprvse.exe</ImagePath>
<CommandLine>C:\Windows\system32\wbem\wmiprvse.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Description>WMI Provider Host</Description>
<modulelist>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x450000</BaseAddress>
<Size>266240</Size>
<Path>C:\Windows\system32\wbem\wmiprvse.exe</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Provider Host</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x73280000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINBRAND.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Branding Resources</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x73950000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\framedynos.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI SDK Provider Framework</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x73990000</BaseAddress>
<Size>1351680</Size>
<Path>C:\Windows\system32\wbem\cimwin32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Win32 Provider</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x73fe0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\SCHEDCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Scheduler Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x74010000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\BROWCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Browser Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\DSROLE.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x74280000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\wbem\wmiutils.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x74560000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\NCObjAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\SAMCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\FastProx.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x754f0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\schannel.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TLS / SSL Security Provider</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75530000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\LOGONCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Logon Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256934</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>44</ProcessIndex>
<ProcessId>3068</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130411322053987325</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x67440000</BaseAddress>
<Size>1257472</Size>
<Path>C:\Windows\System32\msxml3.dll</Path>
<Version>8.110.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 3.0 SP11</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x6dea0000</BaseAddress>
<Size>278528</Size>
<Path>c:\windows\system32\upnphost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>UPnP Device Host</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x6e000000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\httpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>HTTP Protocol Stack API</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x6e080000</BaseAddress>
<Size>819200</Size>
<Path>c:\windows\system32\fntcache.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Font Cache Service</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x6fad0000</BaseAddress>
<Size>53248</Size>
<Path>c:\windows\system32\SSDPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x71850000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\ktmw32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows KTM Win32 Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x733d0000</BaseAddress>
<Size>172032</Size>
<Path>c:\windows\system32\ssdpsrv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Service DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>c:\windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981256993</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>45</ProcessIndex>
<ProcessId>3236</ProcessId>
<ParentProcessId>3212</ParentProcessId>
<ParentProcessIndex>46</ParentProcessIndex>
<AuthenticationId>00000000:00021a24</AuthenticationId>
<CreateTime>130411322068027350</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>High</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>GUI.exe</ProcessName>
<ImagePath>C:\Program Files\GIGABYTE\ET6\GUI.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\GIGABYTE\ET6\GUI.exe&quot; -m</CommandLine>
<CompanyName></CompanyName>
<Version>1, 0, 0, 1</Version>
<Description>GUI MFC Application</Description>
<modulelist>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x200000</BaseAddress>
<Size>507904</Size>
<Path>C:\Program Files\GIGABYTE\ET6\work.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x290000</BaseAddress>
<Size>114688</Size>
<Path>C:\Program Files\GIGABYTE\ET6\SF.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>SF DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x2b0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Program Files\GIGABYTE\ET6\CIAMIB.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>CIAMIB DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x2d0000</BaseAddress>
<Size>102400</Size>
<Path>C:\Program Files\GIGABYTE\ET6\ycc.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>233472</Size>
<Path>C:\Program Files\GIGABYTE\ET6\GUI.exe</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>GUI MFC Application</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x440000</BaseAddress>
<Size>167936</Size>
<Path>C:\Program Files\GIGABYTE\ET6\OCK.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>OCK DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x470000</BaseAddress>
<Size>69632</Size>
<Path>C:\Program Files\GIGABYTE\ET6\GPTT.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x490000</BaseAddress>
<Size>106496</Size>
<Path>C:\Program Files\GIGABYTE\ET6\IccLibDll.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x4b0000</BaseAddress>
<Size>143360</Size>
<Path>C:\Program Files\GIGABYTE\ET6\StabilityLib.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>StabilityLib DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x4e0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Program Files\GIGABYTE\ET6\HM.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>HM DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x500000</BaseAddress>
<Size>221184</Size>
<Path>C:\Program Files\GIGABYTE\ET6\GVTunner.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>GVTunner DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x540000</BaseAddress>
<Size>114688</Size>
<Path>C:\Program Files\GIGABYTE\ET6\Sound.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x560000</BaseAddress>
<Size>118784</Size>
<Path>C:\Program Files\GIGABYTE\ET6\AMD8.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>AMD8 DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x5d0000</BaseAddress>
<Size>4448256</Size>
<Path>C:\Program Files\GIGABYTE\ET6\Platform.dll</Path>
<Version>3.1.0</Version>
<Company></Company>
<Description>Platform Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0xa10000</BaseAddress>
<Size>462848</Size>
<Path>C:\Program Files\GIGABYTE\ET6\Device.dll</Path>
<Version>3.1.0</Version>
<Company></Company>
<Description>Device Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x1b60000</BaseAddress>
<Size>327680</Size>
<Path>C:\Program Files\GIGABYTE\ET6\MFCCPU.DLL</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>MFCCPU DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>2682880</Size>
<Path>C:\Program Files\GIGABYTE\ET6\Normal.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>Normal DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x6e3d0000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\wdmaud.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winmm  audio system driver</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x6f670000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\midimap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MIDI Mapper</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x6fa80000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\msacm32.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sound Mapper</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x70a30000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\oledlg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE User Interface Support</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x72ff0000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\OLEPRO32.DLL</Path>
<Version>6.1.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x73010000</BaseAddress>
<Size>634880</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x730b0000</BaseAddress>
<Size>552960</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCP80.dll</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C++ Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x73240000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\pdh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Performance Data Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\MSACM32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\system32\MMDevAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257053</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>47</ProcessIndex>
<ProcessId>3360</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411322071303356</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>c:\windows\system32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x73150000</BaseAddress>
<Size>57344</Size>
<Path>c:\windows\system32\FwRemoteSvr.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall Remote APIs Server</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x73160000</BaseAddress>
<Size>360448</Size>
<Path>c:\windows\system32\ipsecsvc.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows IPsec SPD Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>c:\windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257117</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>48</ProcessIndex>
<ProcessId>3544</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322087371384</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>1</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>nusb3mon.exe</ProcessName>
<ImagePath>C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe&quot; </CommandLine>
<CompanyName>Renesas Electronics Corporation</CompanyName>
<Version>2.0.28.0</Version>
<Description>USB 3.0 Monitor</Description>
<modulelist>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>114688</Size>
<Path>C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe</Path>
<Version>2.0.28.0</Version>
<Company>Renesas Electronics Corporation</Company>
<Description>USB 3.0 Monitor</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>94208</Size>
<Path>C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.dll</Path>
<Version>2.0.28.0</Version>
<Company>Renesas Electronics Corporation</Company>
<Description>USB 3.0 Monitor</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257179</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>49</ProcessIndex>
<ProcessId>3552</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322087527384</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>AvastUI.exe</ProcessName>
<ImagePath>C:\Program Files\AVAST Software\Avast\AvastUI.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\AVAST Software\Avast\AvastUI.exe&quot; /nogui</CommandLine>
<CompanyName>AVAST Software</CompanyName>
<Version>8.0.1506.399</Version>
<Description>avast! Antivirus</Description>
<modulelist>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0xd0000</BaseAddress>
<Size>4853760</Size>
<Path>C:\Program Files\AVAST Software\Avast\AvastUI.exe</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Antivirus</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6b010000</BaseAddress>
<Size>348160</Size>
<Path>C:\Windows\system32\WinSATAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows System Assessment Tool API</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6bc40000</BaseAddress>
<Size>9719808</Size>
<Path>C:\Windows\system32\ieframe.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Browser</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6ce60000</BaseAddress>
<Size>7716864</Size>
<Path>C:\Windows\system32\nvd3dum.dll</Path>
<Version>8.15.11.8593</Version>
<Company>NVIDIA Corporation</Company>
<Description>NVIDIA Compatible Vista WDDM D3D Driver, Version 185.93 </Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6da20000</BaseAddress>
<Size>466944</Size>
<Path>C:\Windows\system32\DSOUND.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectSound</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6e400000</BaseAddress>
<Size>6406144</Size>
<Path>C:\Program Files\AVAST Software\Avast\CommonRes.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Common UI resources</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6ea20000</BaseAddress>
<Size>253952</Size>
<Path>C:\Program Files\AVAST Software\Avast\1033\UILangRes.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>UILangRes</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6ea60000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswData.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! UI Layer library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6eaa0000</BaseAddress>
<Size>2101248</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswAra.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>aswARA.dll</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6ef30000</BaseAddress>
<Size>3805184</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4bf5400abf9d60b7\mfc90u.dll</Path>
<Version>9.00.30729.4148</Version>
<Company>Microsoft Corporation</Company>
<Description>MFCDLL Shared Library - Retail Version</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x6fa90000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4973eb1d754a9dc9\MFC90ENU.DLL</Path>
<Version>9.00.30729.4148</Version>
<Company>Microsoft Corporation</Company>
<Description>MFC Language Specific Resources</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x70200000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\dxgi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Graphics Infrastructure</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x70ac0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\OLEACC.dll</Path>
<Version>7.0.0.0 (win7sp1_gdr.110826-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Accessibility Core Component</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x70cf0000</BaseAddress>
<Size>1191936</Size>
<Path>C:\Program Files\AVAST Software\Avast\LIBEAY32.dll</Path>
<Version>1.0.1c</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x70e20000</BaseAddress>
<Size>282624</Size>
<Path>C:\Program Files\AVAST Software\Avast\SSLEAY32.dll</Path>
<Version>1.0.1c</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x719a0000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\AVAST Software\Avast\avastIP.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>aswDld Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x719d0000</BaseAddress>
<Size>921600</Size>
<Path>C:\Program Files\AVAST Software\Avast\Aavm4h.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Asynchronous Virus Monitor (AAVM)</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x71ac0000</BaseAddress>
<Size>151552</Size>
<Path>C:\Program Files\AVAST Software\Avast\AavmRpch.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! AAVM Remote Procedure Call Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x71af0000</BaseAddress>
<Size>479232</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswSqLt.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! SQLite library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x71b70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswLog.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Log library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x71bc0000</BaseAddress>
<Size>163840</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashTask.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Task Handling Module</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x71bf0000</BaseAddress>
<Size>688128</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswAux.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Auxiliary Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x71ca0000</BaseAddress>
<Size>270336</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswProperty.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Property Storage library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x71ee0000</BaseAddress>
<Size>1183744</Size>
<Path>C:\Program Files\AVAST Software\Avast\dbghelp.dll</Path>
<Version>6.11.0001.404 (debuggers(dbg).090225-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x72010000</BaseAddress>
<Size>57344</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswEngLdr.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus engine loader</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x720c0000</BaseAddress>
<Size>970752</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashBase.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Basic Functionality Module</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x721b0000</BaseAddress>
<Size>581632</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C++ Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x72240000</BaseAddress>
<Size>667648</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x722f0000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnIS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus independent functions</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x72330000</BaseAddress>
<Size>126976</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnOS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus HW dependent library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x72350000</BaseAddress>
<Size>389120</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnBS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Common functions</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x729e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswUtil.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Utility library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\Windows\system32\CRYPTUI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x73370000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040400\uiExt.dll</Path>
<Version>7.0.1506.282</Version>
<Company>AVAST Software</Company>
<Description>avast! UI extension library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\MMDevApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\System32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75bd0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\SPINF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPINF</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257239</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>50</ProcessIndex>
<ProcessId>3768</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322097203405</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>ACDaemon.exe</ProcessName>
<ImagePath>C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe&quot; </CommandLine>
<CompanyName>ArcSoft Inc.</CompanyName>
<Version>1.1.0.49</Version>
<Description>ArcSoft Connect Daemon</Description>
<modulelist>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe</Path>
<Version>1.1.0.49</Version>
<Company>ArcSoft Inc.</Company>
<Description>ArcSoft Connect Daemon</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>409600</Size>
<Path>C:\Program Files\Common Files\ArcSoft\Bin\ArcCon.dll</Path>
<Version>1.1.0.49</Version>
<Company>ArcSoft Inc.</Company>
<Description>ArcSoft Connect</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x6fd90000</BaseAddress>
<Size>2359296</Size>
<Path>C:\Windows\system32\msi.dll</Path>
<Version>5.0.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Installer</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x70bd0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\sensapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SENS Connectivity API DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\iphlpapi.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x744d0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\rtutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Routing Utilities</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\dnsapi.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257298</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>51</ProcessIndex>
<ProcessId>3800</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322102475413</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>jusched.exe</ProcessName>
<ImagePath>C:\Program Files\Common Files\Java\Java Update\jusched.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Common Files\Java\Java Update\jusched.exe&quot; </CommandLine>
<CompanyName>Oracle Corporation</CompanyName>
<Version>2.1.9.8</Version>
<Description>Java(TM) Update Scheduler</Description>
<modulelist>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>266240</Size>
<Path>C:\Program Files\Common Files\Java\Java Update\jusched.exe</Path>
<Version>2.1.9.8</Version>
<Company>Oracle Corporation</Company>
<Description>Java(TM) Update Scheduler</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257411</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>52</ProcessIndex>
<ProcessId>4012</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322136795473</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Plex Media Server.exe</ProcessName>
<ImagePath>C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe&quot; </CommandLine>
<CompanyName>Plex, Inc.</CompanyName>
<Version>0.9.9.7</Version>
<Description>Plex Media Server</Description>
<modulelist>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x2e0000</BaseAddress>
<Size>376832</Size>
<Path>C:\Program Files\Plex\Plex Media Server\swscale-2.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>1171456</Size>
<Path>C:\Program Files\Plex\Plex Media Server\icuuc40.dll</Path>
<Version>4, 0, 0, 0</Version>
<Company>IBM Corporation and others</Company>
<Description>IBM ICU Common DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x5c0000</BaseAddress>
<Size>1044480</Size>
<Path>C:\Program Files\Plex\Plex Media Server\cairo.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x940000</BaseAddress>
<Size>4427776</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe</Path>
<Version>0.9.9.7</Version>
<Company>Plex, Inc.</Company>
<Description>Plex Media Server</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0xd80000</BaseAddress>
<Size>8536064</Size>
<Path>C:\Program Files\Plex\Plex Media Server\WebKit.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x15b0000</BaseAddress>
<Size>13918208</Size>
<Path>C:\Program Files\Plex\Plex Media Server\icudt40.dll</Path>
<Version>4, 0, 0, 0</Version>
<Company>IBM Corporation and others</Company>
<Description>ICU Data DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>954368</Size>
<Path>C:\Program Files\Plex\Plex Media Server\CFLite.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x66d80000</BaseAddress>
<Size>237568</Size>
<Path>C:\Program Files\Plex\Plex Media Server\avutil-52.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x68b00000</BaseAddress>
<Size>1007616</Size>
<Path>C:\Program Files\Plex\Plex Media Server\WinSparkle.dll</Path>
<Version>0.3.0</Version>
<Company>winsparkle.org</Company>
<Description>WinSparkle updater</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x68f60000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\Plex\Plex Media Server\zlib1.dll</Path>
<Version>1.2.7</Version>
<Company></Company>
<Description>zlib data compression library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x693b0000</BaseAddress>
<Size>1380352</Size>
<Path>C:\Program Files\Plex\Plex Media Server\JavaScriptCore.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x69510000</BaseAddress>
<Size>1310720</Size>
<Path>C:\Program Files\Plex\Plex Media Server\icuin40.dll</Path>
<Version>4, 0, 0, 0</Version>
<Company>IBM Corporation and others</Company>
<Description>IBM ICU I18N DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x69900000</BaseAddress>
<Size>1474560</Size>
<Path>C:\Program Files\Plex\Plex Media Server\avformat-54.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6a0c0000</BaseAddress>
<Size>13365248</Size>
<Path>C:\Program Files\Plex\Plex Media Server\avcodec-54.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6b280000</BaseAddress>
<Size>544768</Size>
<Path>C:\Windows\system32\MSVCP110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6b310000</BaseAddress>
<Size>2236416</Size>
<Path>C:\Program Files\Plex\Plex Media Server\FreeImage.dll</Path>
<Version>3, 15, 4, 0</Version>
<Company>FreeImage</Company>
<Description>FreeImage library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6b570000</BaseAddress>
<Size>45056</Size>
<Path>C:\Program Files\Plex\Plex Media Server\pthreadVC2.dll</Path>
<Version>2, 9, 0, 0</Version>
<Company>Open Source Software community project</Company>
<Description>POSIX Threads for Windows32 Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6c920000</BaseAddress>
<Size>471040</Size>
<Path>C:\Program Files\Plex\Plex Media Server\sqlite3.dll</Path>
<Version>3.8.0.2</Version>
<Company>SQLite Development Team</Company>
<Description>SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine.</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6c9a0000</BaseAddress>
<Size>913408</Size>
<Path>C:\Program Files\Plex\Plex Media Server\iconv.dll</Path>
<Version>_</Version>
<Company>Free Software Foundation</Company>
<Description>LGPLed libiconv for Windows NT/2000/XP/Vista and Windows 95/98/ME</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6cac0000</BaseAddress>
<Size>856064</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libxml2.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6cc60000</BaseAddress>
<Size>1122304</Size>
<Path>C:\Program Files\Plex\Plex Media Server\LIBEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6cd80000</BaseAddress>
<Size>876544</Size>
<Path>C:\Windows\system32\MSVCR110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6d770000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\Plex\Plex Media Server\soci_core-vc80-3_0.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6d790000</BaseAddress>
<Size>61440</Size>
<Path>C:\Program Files\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6d9a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libidn.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6d9e0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Program Files\Plex\Plex Media Server\SSLEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6f2e0000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libcurl.dll</Path>
<Version>7.30.0</Version>
<Company>The cURL library, http://curl.haxx.se/</Company>
<Description>libcurl Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6f350000</BaseAddress>
<Size>516096</Size>
<Path>C:\Program Files\Plex\Plex Media Server\tag.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\CSCAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6f950000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\CSCDLL.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Temporary Shim</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6f960000</BaseAddress>
<Size>434176</Size>
<Path>C:\Windows\System32\cscui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Side Caching UI</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6f9d0000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\system32\EhStorShell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage Shell Extension DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x6ffd0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashShell.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Shell Extension</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x70810000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\Plex\Plex Media Server\zlib.dll</Path>
<Version>1.2.7</Version>
<Company></Company>
<Description>zlib data compression library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x70c70000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\napinsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>E-mail Naming Shim Provider</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\NLAapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\MSWSOCK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257481</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>53</ProcessIndex>
<ProcessId>4024</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322143503485</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>1</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>RaUI.exe</ProcessName>
<ImagePath>C:\Program Files\Ralink\Common\RaUI.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Ralink\Common\RaUI.exe&quot; -s</CommandLine>
<CompanyName>Ralink Technology, Corp.</CompanyName>
<Version>4.1.1.0</Version>
<Description>Ralink Wireless LAN Card Utility</Description>
<modulelist>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>13176832</Size>
<Path>C:\Program Files\Ralink\Common\RaUI.exe</Path>
<Version>4.1.1.0</Version>
<Company>Ralink Technology, Corp.</Company>
<Description>Ralink Wireless LAN Card Utility</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x3150000</BaseAddress>
<Size>1634304</Size>
<Path>C:\Windows\system32\RaCertMgr.dll</Path>
<Version>1, 0, 0, 9</Version>
<Company>Ralink Technology, Corp.</Company>
<Description>RaCertMg Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x4b90000</BaseAddress>
<Size>1093632</Size>
<Path>C:\Program Files\Ralink\Common\CiscoEapFast.dll</Path>
<Version>2, 2, 14, 0</Version>
<Company>Cisco Systems, Inc.</Company>
<Description>Cisco EAP-FAST Module</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x4f70000</BaseAddress>
<Size>552960</Size>
<Path>C:\Program Files\Ralink\Common\ICSDHCP.dll</Path>
<Version>1, 1, 2, 14</Version>
<Company>Ralink Technology, Inc.</Company>
<Description>ICSDHCP DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>1101824</Size>
<Path>C:\Program Files\Ralink\Common\RaWLAPI.dll</Path>
<Version>1, 1, 0, 0</Version>
<Company></Company>
<Description>RaWLAPI DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.DLL</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\WlanApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\wsock32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x72590000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\eappcfg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eap Peer Config</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x725c0000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\eappprxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost Peer Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\iphlpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\Windows\system32\CRYPTUI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x73010000</BaseAddress>
<Size>634880</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x730b0000</BaseAddress>
<Size>552960</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCP80.dll</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C++ Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.DLL</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\OLE32.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257538</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>54</ProcessIndex>
<ProcessId>3888</ProcessId>
<ParentProcessId>4012</ParentProcessId>
<ParentProcessIndex>52</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322343413010</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>PlexDlnaServer.exe</ProcessName>
<ImagePath>C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe&quot; </CommandLine>
<CompanyName>Plex, Inc.</CompanyName>
<Version>0.9.9.7</Version>
<Description>Plex Media Server DLNA Service</Description>
<modulelist>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0xe50000</BaseAddress>
<Size>1642496</Size>
<Path>C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe</Path>
<Version>0.9.9.7</Version>
<Company>Plex, Inc.</Company>
<Description>Plex Media Server DLNA Service</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x6b280000</BaseAddress>
<Size>544768</Size>
<Path>C:\Windows\system32\MSVCP110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x6c920000</BaseAddress>
<Size>471040</Size>
<Path>C:\Program Files\Plex\Plex Media Server\sqlite3.dll</Path>
<Version>3.8.0.2</Version>
<Company>SQLite Development Team</Company>
<Description>SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine.</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x6c9a0000</BaseAddress>
<Size>913408</Size>
<Path>C:\Program Files\Plex\Plex Media Server\iconv.dll</Path>
<Version>_</Version>
<Company>Free Software Foundation</Company>
<Description>LGPLed libiconv for Windows NT/2000/XP/Vista and Windows 95/98/ME</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x6cac0000</BaseAddress>
<Size>856064</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libxml2.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x6cc60000</BaseAddress>
<Size>1122304</Size>
<Path>C:\Program Files\Plex\Plex Media Server\LIBEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x6cd80000</BaseAddress>
<Size>876544</Size>
<Path>C:\Windows\system32\MSVCR110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x6d9a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libidn.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x6d9e0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Program Files\Plex\Plex Media Server\SSLEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x6f2e0000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libcurl.dll</Path>
<Version>7.30.0</Version>
<Company>The cURL library, http://curl.haxx.se/</Company>
<Description>libcurl Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x70810000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\Plex\Plex Media Server\zlib.dll</Path>
<Version>1.2.7</Version>
<Company></Company>
<Description>zlib data compression library</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257600</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>55</ProcessIndex>
<ProcessId>1600</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>5</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411323333499639</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>wmpnetwk.exe</ProcessName>
<ImagePath>C:\Program Files\Windows Media Player\wmpnetwk.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Windows Media Player\wmpnetwk.exe&quot;</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Media Player Network Sharing Service</Description>
<modulelist>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x730000</BaseAddress>
<Size>1142784</Size>
<Path>C:\Program Files\Windows Media Player\wmpnetwk.exe</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player Network Sharing Service</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x65a20000</BaseAddress>
<Size>12632064</Size>
<Path>C:\Windows\system32\wmploc.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player Resources</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x66630000</BaseAddress>
<Size>11485184</Size>
<Path>C:\Windows\system32\wmp.dll</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x67440000</BaseAddress>
<Size>1257472</Size>
<Path>C:\Windows\System32\msxml3.dll</Path>
<Version>8.110.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 3.0 SP11</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6b010000</BaseAddress>
<Size>348160</Size>
<Path>C:\Windows\system32\WinSATAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows System Assessment Tool API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6ca80000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Internet Explorer\ieproxy.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>IE ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6d650000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\devenum.dll</Path>
<Version>6.6.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device enumeration.</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6d760000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\msdmo.dll</Path>
<Version>6.6.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DMO Runtime</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6dad0000</BaseAddress>
<Size>847872</Size>
<Path>C:\Windows\System32\msmpeg2enc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MPEG-2 Encoder</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6dba0000</BaseAddress>
<Size>753664</Size>
<Path>C:\Windows\system32\BlackBox.dll</Path>
<Version>11.0.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>BlackBox DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6dc60000</BaseAddress>
<Size>753664</Size>
<Path>C:\Windows\system32\wmpmde.dll</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMPMDE DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6dd20000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\drmv2clt.dll</Path>
<Version>11.0.7600.16385</Version>
<Company>Microsoft Corporation</Company>
<Description>DRMv2 Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6de20000</BaseAddress>
<Size>516096</Size>
<Path>C:\Windows\system32\wmdrmdev.dll</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media DRM for Network Devices Registration DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6dea0000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\upnphost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>UPnP Device Host</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6def0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\System32\wmpps.dll</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player Proxy Stub Dll</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6e000000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\HTTPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>HTTP Protocol Stack API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6f320000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\System32\provsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HomeGroup</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\System32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x6fad0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\SSDPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x70200000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\dxgi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Graphics Infrastructure</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x729f0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\DAVHLPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DAV Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x72a00000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\davclnt.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web DAV Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x72a20000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\System32\ntlanman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Lan Manager</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x72a40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\drprov.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Remote Desktop Session Host Server Network Provider</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x72a50000</BaseAddress>
<Size>1671168</Size>
<Path>C:\Windows\system32\NetworkExplorer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Explorer</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x72fe0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\LINKINFO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Volume Tracking</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x73490000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\upnp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>UPnP Control Point API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x73da0000</BaseAddress>
<Size>364544</Size>
<Path>C:\Windows\system32\MFPlat.DLL</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Platform DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\windowscodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257664</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>56</ProcessIndex>
<ProcessId>3832</ProcessId>
<ParentProcessId>4012</ParentProcessId>
<ParentProcessIndex>52</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411325446525816</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>PlexScriptHost.exe</ProcessName>
<ImagePath>C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe&quot; &quot;C:\Users\manono\AppData\Local\Plex Media Server\Plug-ins\Framework.bundle\Contents\Resources\Versions\2\Python/bootstrap.py&quot; &quot;C:\Users\manono\AppData\Local\Plex Media Server\Plug-ins\System.bundle&quot;</CommandLine>
<CompanyName>Python Software Foundation</CompanyName>
<Version>2.7.4</Version>
<Description>Python</Description>
<modulelist>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x420000</BaseAddress>
<Size>45056</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\_socket.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x1e10000</BaseAddress>
<Size>24576</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\_hashlib.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x29e0000</BaseAddress>
<Size>118784</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\pyexpat.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x2a00000</BaseAddress>
<Size>692224</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\unicodedata.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>32768</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\_ssl.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x1d000000</BaseAddress>
<Size>40960</Size>
<Path>C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe</Path>
<Version>2.7.4</Version>
<Company>Python Software Foundation</Company>
<Description>Python</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x1d110000</BaseAddress>
<Size>20480</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\select.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x1d1a0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\_ctypes.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x1e000000</BaseAddress>
<Size>2334720</Size>
<Path>C:\Program Files\Plex\Plex Media Server\python27.dll</Path>
<Version>2.7.4</Version>
<Company>Python Software Foundation</Company>
<Description>Python Core</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x6c9a0000</BaseAddress>
<Size>913408</Size>
<Path>C:\Program Files\Plex\Plex Media Server\iconv.dll</Path>
<Version>_</Version>
<Company>Free Software Foundation</Company>
<Description>LGPLed libiconv for Windows NT/2000/XP/Vista and Windows 95/98/ME</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x6cac0000</BaseAddress>
<Size>856064</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libxml2.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x6cc60000</BaseAddress>
<Size>1122304</Size>
<Path>C:\Program Files\Plex\Plex Media Server\LIBEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x6cd80000</BaseAddress>
<Size>876544</Size>
<Path>C:\Windows\system32\MSVCR110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x6d9e0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Program Files\Plex\Plex Media Server\SSLEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x73e20000</BaseAddress>
<Size>876544</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\lxml\etree.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x73f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x73f30000</BaseAddress>
<Size>69632</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x73f50000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\lxml\objectify.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x73f90000</BaseAddress>
<Size>176128</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libxslt.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x73fc0000</BaseAddress>
<Size>73728</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libexslt.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x74740000</BaseAddress>
<Size>36864</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x74750000</BaseAddress>
<Size>24576</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257729</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>57</ProcessIndex>
<ProcessId>3844</ProcessId>
<ParentProcessId>560</ParentProcessId>
<ParentProcessIndex>15</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411325455006301</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>conhost.exe</ProcessName>
<ImagePath>C:\Windows\system32\conhost.exe</ImagePath>
<CommandLine>\??\C:\Windows\system32\conhost.exe &quot;-1976565619156858560954269388938188644-2028549832-458736635-15438194331143419393</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Console Window Host</Description>
<modulelist>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0xaa0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\conhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Console Window Host</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257821</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>58</ProcessIndex>
<ProcessId>2472</ProcessId>
<ParentProcessId>1136</ParentProcessId>
<ParentProcessIndex>25</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411455000021167</CreateTime>
<FinishTime>130411458011541752</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>taskeng.exe</ProcessName>
<ImagePath>C:\Windows\system32\taskeng.exe</ImagePath>
<CommandLine>taskeng.exe {8A0DB675-5B7D-46C2-AE6A-4D85600C178B}</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Task Scheduler Engine</Description>
<modulelist>
</modulelist>
</process>
<process>
<ProcessIndex>59</ProcessIndex>
<ProcessId>1820</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411455324033736</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>firefox.exe</ProcessName>
<ImagePath>C:\Program Files\Mozilla Firefox\firefox.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Mozilla Firefox\firefox.exe&quot; </CommandLine>
<CompanyName>Mozilla Corporation</CompanyName>
<Version>28.0</Version>
<Description>Firefox</Description>
<modulelist>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0xe60000</BaseAddress>
<Size>278528</Size>
<Path>C:\Program Files\Mozilla Firefox\firefox.exe</Path>
<Version>28.0</Version>
<Company>Mozilla Corporation</Company>
<Description>Firefox</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x60560000</BaseAddress>
<Size>24518656</Size>
<Path>C:\Program Files\Mozilla Firefox\xul.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x64620000</BaseAddress>
<Size>6123520</Size>
<Path>C:\Program Files\Mozilla Firefox\gkmedias.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x64c00000</BaseAddress>
<Size>3678208</Size>
<Path>C:\Program Files\Mozilla Firefox\mozjs.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x68590000</BaseAddress>
<Size>3219456</Size>
<Path>C:\Windows\system32\mf.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x69020000</BaseAddress>
<Size>1089536</Size>
<Path>C:\Windows\system32\dwrite.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DirectX Typography Services</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x69130000</BaseAddress>
<Size>1810432</Size>
<Path>C:\Program Files\Mozilla Firefox\nss3.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x692f0000</BaseAddress>
<Size>778240</Size>
<Path>C:\Program Files\Mozilla Firefox\MSVCR100.dll</Path>
<Version>10.00.30319.1</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x6a410000</BaseAddress>
<Size>208896</Size>
<Path>C:\Windows\system32\mfreadwrite.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation ReadWrite DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x6a690000</BaseAddress>
<Size>405504</Size>
<Path>C:\Program Files\Mozilla Firefox\nssckbi.dll</Path>
<Version>1.96</Version>
<Company>Mozilla Foundation</Company>
<Description>NSS Builtin Trusted Root CAs</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x6a750000</BaseAddress>
<Size>430080</Size>
<Path>C:\Program Files\Mozilla Firefox\MSVCP100.dll</Path>
<Version>10.00.30319.1</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x6d650000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\devenum.dll</Path>
<Version>6.6.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device enumeration.</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x6d670000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\Mozilla Firefox\nssdbm3.dll</Path>
<Version>3.15.5 Basic ECC</Version>
<Company>Mozilla Foundation</Company>
<Description>Legacy Database Driver</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x6d760000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\msdmo.dll</Path>
<Version>6.6.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DMO Runtime</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x70020000</BaseAddress>
<Size>1503232</Size>
<Path>C:\Windows\system32\explorerframe.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ExplorerFrame</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x702d0000</BaseAddress>
<Size>495616</Size>
<Path>C:\Windows\system32\mscms.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Color Matching System DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x703d0000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\dxva2.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Video Acceleration 2.0 DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x70c70000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\napinsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>E-mail Naming Shim Provider</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x72900000</BaseAddress>
<Size>159744</Size>
<Path>C:\Program Files\Mozilla Firefox\softokn3.dll</Path>
<Version>3.15.5 Basic ECC</Version>
<Company>Mozilla Foundation</Company>
<Description>NSS PKCS #11 Library</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x72fe0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\LINKINFO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Volume Tracking</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x73750000</BaseAddress>
<Size>147456</Size>
<Path>C:\Program Files\Mozilla Firefox\mozglue.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x737b0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Program Files\Mozilla Firefox\mozalloc.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x737c0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswJsFlt.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Script Blocking filter library</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x73da0000</BaseAddress>
<Size>364544</Size>
<Path>C:\Windows\system32\mfplat.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Platform DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x73e10000</BaseAddress>
<Size>53248</Size>
<Path>C:\Program Files\Mozilla Firefox\browser\components\browsercomps.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\NLAapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\SAMCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\MMDevApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74af0000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\DUser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUser Engine</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\Windows\system32\DUI70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\propsys.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981257955</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>60</ProcessIndex>
<ProcessId>1428</ProcessId>
<ParentProcessId>1820</ParentProcessId>
<ParentProcessIndex>59</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411457854320114</CreateTime>
<FinishTime>130411459812881401</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>plugin-container.exe</ProcessName>
<ImagePath>C:\Program Files\Mozilla Firefox\plugin-container.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Mozilla Firefox\plugin-container.exe&quot; --channel=1820.f959480.86564770 &quot;C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll&quot; -greomni &quot;C:\Program Files\Mozilla Firefox\omni.ja&quot; -appomni &quot;C:\Program Files\Mozilla Firefox\browser\omni.ja&quot; -appdir &quot;C:\Program Files\Mozilla Firefox\browser&quot; 308046B0AF4A39CB 1820 &quot;\\.\pipe\gecko-crash-server-pipe.1820&quot; plugin</CommandLine>
<CompanyName>Mozilla Corporation</CompanyName>
<Version>28.0</Version>
<Description>Plugin Container for Firefox</Description>
<modulelist>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0xad0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Program Files\Mozilla Firefox\plugin-container.exe</Path>
<Version>28.0</Version>
<Company>Mozilla Corporation</Company>
<Description>Plugin Container for Firefox</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x5f4e0000</BaseAddress>
<Size>17293312</Size>
<Path>C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll</Path>
<Version>12,0,0,77</Version>
<Company>Adobe Systems, Inc.</Company>
<Description>Shockwave Flash 12.0 r0</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x60560000</BaseAddress>
<Size>24518656</Size>
<Path>C:\Program Files\Mozilla Firefox\xul.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x64620000</BaseAddress>
<Size>6123520</Size>
<Path>C:\Program Files\Mozilla Firefox\gkmedias.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x64c00000</BaseAddress>
<Size>3678208</Size>
<Path>C:\Program Files\Mozilla Firefox\mozjs.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x69130000</BaseAddress>
<Size>1810432</Size>
<Path>C:\Program Files\Mozilla Firefox\nss3.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x692f0000</BaseAddress>
<Size>778240</Size>
<Path>C:\Program Files\Mozilla Firefox\MSVCR100.dll</Path>
<Version>10.00.30319.1</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x6a750000</BaseAddress>
<Size>430080</Size>
<Path>C:\Program Files\Mozilla Firefox\MSVCP100.dll</Path>
<Version>10.00.30319.1</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x6d6d0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\icm32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Color Management Module (CMM)</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x6d710000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\DINPUT8.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DirectInput</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x6da20000</BaseAddress>
<Size>466944</Size>
<Path>C:\Windows\system32\DSOUND.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectSound</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x702d0000</BaseAddress>
<Size>495616</Size>
<Path>C:\Windows\system32\mscms.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Color Matching System DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x73750000</BaseAddress>
<Size>147456</Size>
<Path>C:\Program Files\Mozilla Firefox\mozglue.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x737b0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Program Files\Mozilla Firefox\mozalloc.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\SAMCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\MMDevApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\System32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411459812855601</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\WINDOWS\SYSTEM32\wintrust.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981258190</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>61</ProcessIndex>
<ProcessId>1592</ProcessId>
<ParentProcessId>1428</ParentProcessId>
<ParentProcessIndex>60</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411457856720251</CreateTime>
<FinishTime>130411459812872875</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>FlashPlayerPlugin_12_0_0_77.exe</ProcessName>
<ImagePath>C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe</ImagePath>
<CommandLine>&quot;C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe&quot; --proxy-stub-channel=Flash1428.61587F48.13005 --host-broker-channel=Flash1428.61587F48.11309 --host-pid=1428 --host-npapi-version=27 --plugin-path=&quot;C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll&quot;</CommandLine>
<CompanyName>Adobe Systems, Inc.</CompanyName>
<Version>12,0,0,77</Version>
<Description>Adobe Flash Player 12.0 r0</Description>
<modulelist>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x1080000</BaseAddress>
<Size>1888256</Size>
<Path>C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe</Path>
<Version>12,0,0,77</Version>
<Company>Adobe Systems, Inc.</Company>
<Description>Adobe Flash Player 12.0 r0</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x6d710000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\DINPUT8.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DirectInput</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x754f0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\schannel.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TLS / SSL Security Provider</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\version.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981258252</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>62</ProcessIndex>
<ProcessId>3300</ProcessId>
<ParentProcessId>1592</ParentProcessId>
<ParentProcessIndex>61</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411457858850373</CreateTime>
<FinishTime>130411459812845739</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Low</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>FlashPlayerPlugin_12_0_0_77.exe</ProcessName>
<ImagePath>C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe</ImagePath>
<CommandLine>&quot;C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe&quot; --channel=1592.0023F238.67834827 --proxy-stub-channel=Flash1428.61587F48.13005 --plugin-path=&quot;C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll&quot; --host-npapi-version=27 --type=renderer</CommandLine>
<CompanyName>Adobe Systems, Inc.</CompanyName>
<Version>12,0,0,77</Version>
<Description>Adobe Flash Player 12.0 r0</Description>
<modulelist>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x1080000</BaseAddress>
<Size>1888256</Size>
<Path>C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe</Path>
<Version>12,0,0,77</Version>
<Company>Adobe Systems, Inc.</Company>
<Description>Adobe Flash Player 12.0 r0</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x5f4e0000</BaseAddress>
<Size>17293312</Size>
<Path>C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll</Path>
<Version>12,0,0,77</Version>
<Company>Adobe Systems, Inc.</Company>
<Description>Shockwave Flash 12.0 r0</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x67c30000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\system32\mlang.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi Language Support DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x6d710000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\DINPUT8.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DirectInput</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x6da20000</BaseAddress>
<Size>466944</Size>
<Path>C:\Windows\system32\DSOUND.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectSound</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x702d0000</BaseAddress>
<Size>495616</Size>
<Path>C:\Windows\system32\mscms.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Color Matching System DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\MMDevApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\System32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457981258314</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>63</ProcessIndex>
<ProcessId>3588</ProcessId>
<ParentProcessId>1056</ParentProcessId>
<ParentProcessIndex>23</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130411457859610416</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>AUDIODG.EXE</ProcessName>
<ImagePath>C:\Windows\system32\AUDIODG.EXE</ImagePath>
<CommandLine>C:\Windows\system32\AUDIODG.EXE 0x7d4</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Audio Device Graph Isolation </Description>
<modulelist>
</modulelist>
</process>
<process>
<ProcessIndex>64</ProcessIndex>
<ProcessId>4220</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>19</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411457976287090</CreateTime>
<FinishTime>130411458027144725</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>DllHost.exe</ProcessName>
<ImagePath>C:\Windows\system32\DllHost.exe</ImagePath>
<CommandLine>C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>COM Surrogate</Description>
<modulelist>
</modulelist>
</process>
<process>
<ProcessIndex>65</ProcessIndex>
<ProcessId>4256</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>19</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411457977557162</CreateTime>
<FinishTime>130411458027792036</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>DllHost.exe</ProcessName>
<ImagePath>C:\Windows\system32\DllHost.exe</ImagePath>
<CommandLine>C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>COM Surrogate</Description>
<modulelist>
</modulelist>
</process>
<process>
<ProcessIndex>66</ProcessIndex>
<ProcessId>4380</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>19</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411457992601441</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>wmiprvse.exe</ProcessName>
<ImagePath>C:\Windows\system32\wbem\wmiprvse.exe</ImagePath>
<CommandLine>C:\Windows\system32\wbem\wmiprvse.exe -Embedding</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Description>WMI Provider Host</Description>
<modulelist>
<module>
<Timestamp>130411457992605526</Timestamp>
<BaseAddress>0x450000</BaseAddress>
<Size>266240</Size>
<Path>C:\Windows\System32\wbem\WmiPrvSE.exe</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Provider Host</Description>
</module>
<module>
<Timestamp>130411457997491074</Timestamp>
<BaseAddress>0x6a3b0000</BaseAddress>
<Size>163840</Size>
<Path>C:\Windows\System32\WBEM\wmiprov.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457997247474</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\System32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457997334810</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\WBEM\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457997220775</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411457997456430</Timestamp>
<BaseAddress>0x74280000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\WBEM\wmiutils.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457997314370</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\System32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130411457997264920</Timestamp>
<BaseAddress>0x74560000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\ncobjapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457997416023</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\WBEM\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130411457997260266</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\System32\ntdsapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130411457997256016</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\System32\WBEM\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130411457997395665</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411457997343870</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\cryptsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411457997307995</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411457997402423</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411457997223259</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457997248544</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411457997221850</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411457997242737</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\System32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411457997241680</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411457997328846</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\System32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411457997240584</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411457997278563</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\System32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411457997234092</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411457997251484</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\System32\ws2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411457997230174</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411457997249247</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\System32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411457997252586</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\nsi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411457997279765</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\System32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411457997238595</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\System32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411457997236372</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411457992607997</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411457997315510</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\System32\Wldap32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>67</ProcessIndex>
<ProcessId>5356</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411458324389183</CreateTime>
<FinishTime>130411458347924139</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>MKV2AC3.exe</ProcessName>
<ImagePath>C:\Program Files\MKV2AC3\MKV2AC3.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\MKV2AC3\MKV2AC3.exe&quot; </CommandLine>
<CompanyName></CompanyName>
<Version>0.0.0.0</Version>
<Description> </Description>
<modulelist>
<module>
<Timestamp>130411458324437386</Timestamp>
<BaseAddress>0x1360000</BaseAddress>
<Size>761856</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411458324439448</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>68</ProcessIndex>
<ProcessId>5380</ProcessId>
<ParentProcessId>1136</ParentProcessId>
<ParentProcessIndex>25</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411458348002571</CreateTime>
<FinishTime>130411458363162101</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>consent.exe</ProcessName>
<ImagePath>C:\Windows\system32\consent.exe</ImagePath>
<CommandLine>consent.exe 1136 294 06894D90</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Consent UI for administrative applications</Description>
<modulelist>
<module>
<Timestamp>130411458348659352</Timestamp>
<BaseAddress>0x530000</BaseAddress>
<Size>761856</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411458348006417</Timestamp>
<BaseAddress>0x8e0000</BaseAddress>
<Size>110592</Size>
<Path>C:\WINDOWS\SYSTEM32\consent.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Consent UI for administrative applications</Description>
</module>
<module>
<Timestamp>130411458362582524</Timestamp>
<BaseAddress>0x2180000</BaseAddress>
<Size>761856</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411458349239419</Timestamp>
<BaseAddress>0x632c0000</BaseAddress>
<Size>20275200</Size>
<Path>C:\WINDOWS\SYSTEM32\imageres.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Resource</Description>
</module>
<module>
<Timestamp>130411458349161690</Timestamp>
<BaseAddress>0x6e3d0000</BaseAddress>
<Size>196608</Size>
<Path>C:\WINDOWS\SYSTEM32\wdmaud.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winmm  audio system driver</Description>
</module>
<module>
<Timestamp>130411458349434587</Timestamp>
<BaseAddress>0x6f670000</BaseAddress>
<Size>28672</Size>
<Path>C:\WINDOWS\SYSTEM32\midimap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MIDI Mapper</Description>
</module>
<module>
<Timestamp>130411458349418354</Timestamp>
<BaseAddress>0x6fa80000</BaseAddress>
<Size>32768</Size>
<Path>C:\WINDOWS\SYSTEM32\msacm32.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sound Mapper</Description>
</module>
<module>
<Timestamp>130411458348077595</Timestamp>
<BaseAddress>0x70290000</BaseAddress>
<Size>180224</Size>
<Path>C:\WINDOWS\SYSTEM32\msutb.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSUTB Server DLL</Description>
</module>
<module>
<Timestamp>130411458348071454</Timestamp>
<BaseAddress>0x702c0000</BaseAddress>
<Size>32768</Size>
<Path>C:\WINDOWS\SYSTEM32\MsCtfMonitor.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MsCtfMonitor DLL</Description>
</module>
<module>
<Timestamp>130411458348043994</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\WINDOWS\SYSTEM32\msimg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130411458348015272</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411458349150685</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130411458349144371</Timestamp>
<BaseAddress>0x72cf0000</BaseAddress>
<Size>1798144</Size>
<Path>C:\WINDOWS\SYSTEM32\authui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Authentication UI</Description>
</module>
<module>
<Timestamp>130411458349422024</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\WINDOWS\SYSTEM32\msacm32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130411458349254456</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\WINDOWS\SYSTEM32\AudioSes.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130411458348054768</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\WINDOWS\SYSTEM32\winmm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411458349165797</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\WINDOWS\SYSTEM32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130411458349118089</Timestamp>
<BaseAddress>0x74660000</BaseAddress>
<Size>176128</Size>
<Path>C:\WINDOWS\SYSTEM32\credui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Manager User Interface</Description>
</module>
<module>
<Timestamp>130411458349228999</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\WINDOWS\SYSTEM32\xmllite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130411458349219120</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411458349131884</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\WINDOWS\SYSTEM32\MMDevAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130411458349207514</Timestamp>
<BaseAddress>0x74af0000</BaseAddress>
<Size>192512</Size>
<Path>C:\WINDOWS\SYSTEM32\duser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUser Engine</Description>
</module>
<module>
<Timestamp>130411458349192291</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\WINDOWS\SYSTEM32\dui70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130411458349184603</Timestamp>
<BaseAddress>0x74be0000</BaseAddress>
<Size>1638400</Size>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft GDI+</Description>
</module>
<module>
<Timestamp>130411458349136112</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\WINDOWS\SYSTEM32\propsys.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130411458348084148</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411458348290658</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\WINDOWS\SYSTEM32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411458349169645</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\WINDOWS\SYSTEM32\avrt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130411458348212083</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411458348159932</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411458348284889</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\WINDOWS\SYSTEM32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130411458349223935</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\WINDOWS\SYSTEM32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411458348656118</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\WINDOWS\SYSTEM32\version.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411458348051090</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\WINDOWS\SYSTEM32\wtsapi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130411458348058716</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\WINDOWS\SYSTEM32\userenv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411458348047452</Timestamp>
<BaseAddress>0x75b90000</BaseAddress>
<Size>24576</Size>
<Path>C:\WINDOWS\SYSTEM32\wmsgapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WinLogon IPC Client</Description>
</module>
<module>
<Timestamp>130411458348066336</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\WINDOWS\SYSTEM32\winsta.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130411458348104715</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\WINDOWS\SYSTEM32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411458348108579</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\WINDOWS\SYSTEM32\sspicli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411458348142993</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411458348062623</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411458348068384</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\WINDOWS\SYSTEM32\msasn1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130411458349177446</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\WINDOWS\SYSTEM32\cfgmgr32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411458349179063</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\WINDOWS\SYSTEM32\devobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411458348153042</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\WINDOWS\SYSTEM32\wintrust.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130411458348067465</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\WINDOWS\SYSTEM32\crypt32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130411458348017629</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\WINDOWS\SYSTEM32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458348661753</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\WINDOWS\SYSTEM32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411458349176104</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\WINDOWS\SYSTEM32\setupapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411458348016403</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\WINDOWS\SYSTEM32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458348038726</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\WINDOWS\SYSTEM32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411458348037702</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\WINDOWS\SYSTEM32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411458348660872</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\WINDOWS\SYSTEM32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411458348672092</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\WINDOWS\SYSTEM32\normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411458348034544</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\WINDOWS\SYSTEM32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411458348073534</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\WINDOWS\SYSTEM32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411458348029276</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411458348085361</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\WINDOWS\SYSTEM32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411458348025350</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\WINDOWS\SYSTEM32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411458348668021</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\WINDOWS\SYSTEM32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411458348670737</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\WINDOWS\SYSTEM32\wininet.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411458348669500</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\WINDOWS\SYSTEM32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411458348039855</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\WINDOWS\SYSTEM32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411458348072340</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\WINDOWS\SYSTEM32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411458348231326</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\WINDOWS\SYSTEM32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130411458348035619</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\WINDOWS\SYSTEM32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411458348031736</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\WINDOWS\SYSTEM32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411458348118988</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\WINDOWS\SYSTEM32\shell32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411458348008521</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\WINDOWS\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411458348024504</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\WINDOWS\SYSTEM32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>69</ProcessIndex>
<ProcessId>5452</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>19</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411458362599156</CreateTime>
<FinishTime>130411458412853281</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>DllHost.exe</ProcessName>
<ImagePath>C:\Windows\system32\DllHost.exe</ImagePath>
<CommandLine>C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>COM Surrogate</Description>
<modulelist>
<module>
<Timestamp>130411458362607000</Timestamp>
<BaseAddress>0x210000</BaseAddress>
<Size>20480</Size>
<Path>C:\WINDOWS\SYSTEM32\dllhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM Surrogate</Description>
</module>
<module>
<Timestamp>130411458362771483</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411458362615149</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411458362765218</Timestamp>
<BaseAddress>0x73380000</BaseAddress>
<Size>122880</Size>
<Path>C:\WINDOWS\SYSTEM32\shacct.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Accounts Classes</Description>
</module>
<module>
<Timestamp>130411458362797722</Timestamp>
<BaseAddress>0x73780000</BaseAddress>
<Size>57344</Size>
<Path>C:\WINDOWS\SYSTEM32\IDStore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Identity Store</Description>
</module>
<module>
<Timestamp>130411458362740437</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411458362689222</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411458362781966</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\WINDOWS\SYSTEM32\userenv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411458362664805</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411458362748346</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411458362786010</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411458362617329</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\WINDOWS\SYSTEM32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458362674376</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\WINDOWS\SYSTEM32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411458362616198</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\WINDOWS\SYSTEM32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458362631140</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\WINDOWS\SYSTEM32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411458362629930</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\WINDOWS\SYSTEM32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411458362667208</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\WINDOWS\SYSTEM32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411458362626685</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\WINDOWS\SYSTEM32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411458362646093</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\WINDOWS\SYSTEM32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411458362671291</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411458362775579</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\WINDOWS\SYSTEM32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411458362624257</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\WINDOWS\SYSTEM32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411458362625699</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\WINDOWS\SYSTEM32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411458362647397</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\WINDOWS\SYSTEM32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411458362627790</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\WINDOWS\SYSTEM32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411458362633177</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\WINDOWS\SYSTEM32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411458362608997</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\WINDOWS\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411458362667968</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\WINDOWS\SYSTEM32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>70</ProcessIndex>
<ProcessId>5488</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>19</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411458363192689</CreateTime>
<FinishTime>130411458413510684</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>DllHost.exe</ProcessName>
<ImagePath>C:\Windows\system32\DllHost.exe</ImagePath>
<CommandLine>C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>COM Surrogate</Description>
<modulelist>
<module>
<Timestamp>130411458363203425</Timestamp>
<BaseAddress>0x210000</BaseAddress>
<Size>20480</Size>
<Path>C:\WINDOWS\SYSTEM32\dllhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM Surrogate</Description>
</module>
<module>
<Timestamp>130411458363429794</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411458363219272</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411458363423667</Timestamp>
<BaseAddress>0x73380000</BaseAddress>
<Size>122880</Size>
<Path>C:\WINDOWS\SYSTEM32\shacct.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Accounts Classes</Description>
</module>
<module>
<Timestamp>130411458363457488</Timestamp>
<BaseAddress>0x73780000</BaseAddress>
<Size>57344</Size>
<Path>C:\WINDOWS\SYSTEM32\IDStore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Identity Store</Description>
</module>
<module>
<Timestamp>130411458363397816</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411458363344795</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411458363441050</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\WINDOWS\SYSTEM32\userenv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411458363312995</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411458363406075</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411458363445211</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411458363223899</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\WINDOWS\SYSTEM32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458363328217</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\WINDOWS\SYSTEM32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411458363220536</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\WINDOWS\SYSTEM32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458363257524</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\WINDOWS\SYSTEM32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411458363254781</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\WINDOWS\SYSTEM32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411458363316185</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\WINDOWS\SYSTEM32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130411458363245934</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\WINDOWS\SYSTEM32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411458363279257</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\WINDOWS\SYSTEM32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411458363322814</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411458363434305</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\WINDOWS\SYSTEM32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411458363235651</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\WINDOWS\SYSTEM32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411458363244721</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\WINDOWS\SYSTEM32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411458363286689</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\WINDOWS\SYSTEM32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411458363248084</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\WINDOWS\SYSTEM32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411458363259195</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\WINDOWS\SYSTEM32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411458363209687</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\WINDOWS\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411458363317144</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\WINDOWS\SYSTEM32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>71</ProcessIndex>
<ProcessId>5520</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>2</ParentProcessIndex>
<AuthenticationId>00000000:00021a24</AuthenticationId>
<CreateTime>130411458363483123</CreateTime>
<FinishTime>130411458541605776</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>High</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>MKV2AC3.exe</ProcessName>
<ImagePath>C:\Program Files\MKV2AC3\MKV2AC3.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\MKV2AC3\MKV2AC3.exe&quot; </CommandLine>
<CompanyName></CompanyName>
<Version>0.0.0.0</Version>
<Description> </Description>
<modulelist>
<module>
<Timestamp>130411458402133097</Timestamp>
<BaseAddress>0x970000</BaseAddress>
<Size>630784</Size>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Version>8.0.50727.5420 (Win7SP1.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>Visual Basic Runtime Library</Description>
</module>
<module>
<Timestamp>130411458487873742</Timestamp>
<BaseAddress>0xb80000</BaseAddress>
<Size>32768</Size>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Version>1.0.0.0</Version>
<Company>Noor Abuhamdeh</Company>
<Description>BalloonToolTip</Description>
</module>
<module>
<Timestamp>130411458492754507</Timestamp>
<BaseAddress>0xbd0000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Version>1.0.0.1</Version>
<Company> </Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411458363578885</Timestamp>
<BaseAddress>0xbe0000</BaseAddress>
<Size>761856</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411458363912157</Timestamp>
<BaseAddress>0x19d0000</BaseAddress>
<Size>761856</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411458491413171</Timestamp>
<BaseAddress>0x2010000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Version>1.0.0.1</Version>
<Company> </Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411458493402578</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>36864</Size>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Version>2.0.50727.4927 (NetFXspW7.050727-4900)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Error Reporting Shim</Description>
</module>
<module>
<Timestamp>130411458491006196</Timestamp>
<BaseAddress>0x11000000</BaseAddress>
<Size>32768</Size>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Version>1.0.0.0</Version>
<Company>Noor Abuhamdeh</Company>
<Description>BalloonToolTip</Description>
</module>
<module>
<Timestamp>130411458528109756</Timestamp>
<BaseAddress>0x5e3a0000</BaseAddress>
<Size>577536</Size>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Version>8.0.50727.5420 (Win7SP1.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>Dia based SymReader</Description>
</module>
<module>
<Timestamp>130411458487367909</Timestamp>
<BaseAddress>0x5e430000</BaseAddress>
<Size>5038080</Size>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Version>2.0.50727.5446 (Win7SP1GDR.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>.NET Framework</Description>
</module>
<module>
<Timestamp>130411458457920048</Timestamp>
<BaseAddress>0x5e900000</BaseAddress>
<Size>12443648</Size>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Version>2.0.50727.5446 (Win7SP1GDR.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>.NET Framework</Description>
</module>
<module>
<Timestamp>130411458492892942</Timestamp>
<BaseAddress>0x60340000</BaseAddress>
<Size>32768</Size>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\Culture.dll</Path>
<Version>2.0.50727.4927 (NetFXspW7.050727-4900)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Globalization Support</Description>
</module>
<module>
<Timestamp>130411458401703494</Timestamp>
<BaseAddress>0x62560000</BaseAddress>
<Size>11501568</Size>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Version>2.0.50727.5448 (Win7SP1GDR.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Common Language Runtime Class Library</Description>
</module>
<module>
<Timestamp>130411458485626681</Timestamp>
<BaseAddress>0x63580000</BaseAddress>
<Size>5464064</Size>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Version>2.0.50727.5420 (Win7SP1.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>.NET Framework</Description>
</module>
<module>
<Timestamp>130411458367178603</Timestamp>
<BaseAddress>0x63ac0000</BaseAddress>
<Size>5943296</Size>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Version>2.0.50727.5448 (Win7SP1GDR.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Common Language Runtime - WorkStation</Description>
</module>
<module>
<Timestamp>130411458470748859</Timestamp>
<BaseAddress>0x64390000</BaseAddress>
<Size>987136</Size>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Version>2.0.50727.5420 (Win7SP1.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>System.Configuration.dll</Description>
</module>
<module>
<Timestamp>130411458437832187</Timestamp>
<BaseAddress>0x64490000</BaseAddress>
<Size>1605632</Size>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Version>2.0.50727.5420 (Win7SP1.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>.NET Framework</Description>
</module>
<module>
<Timestamp>130411458464781685</Timestamp>
<BaseAddress>0x65030000</BaseAddress>
<Size>790528</Size>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Version>2.0.50727.5420 (Win7SP1.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Object Remoting</Description>
</module>
<module>
<Timestamp>130411458363713349</Timestamp>
<BaseAddress>0x65100000</BaseAddress>
<Size>2195456</Size>
<Path>C:\WINDOWS\APPPATCH\AcGenral.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130411458402142342</Timestamp>
<BaseAddress>0x67140000</BaseAddress>
<Size>630784</Size>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Version>8.0.50727.5420 (Win7SP1.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>Visual Basic Runtime Library</Description>
</module>
<module>
<Timestamp>130411458363894431</Timestamp>
<BaseAddress>0x671e0000</BaseAddress>
<Size>2461696</Size>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130411458402220101</Timestamp>
<BaseAddress>0x68310000</BaseAddress>
<Size>372736</Size>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Version>2.0.50727.5446 (Win7SP1GDR.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Just-In-Time Compiler</Description>
</module>
<module>
<Timestamp>130411458363639282</Timestamp>
<BaseAddress>0x688c0000</BaseAddress>
<Size>577536</Size>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130411458363596745</Timestamp>
<BaseAddress>0x68a40000</BaseAddress>
<Size>303104</Size>
<Path>C:\WINDOWS\SYSTEM32\mscoree.dll</Path>
<Version>4.0.40305.0 (Main.040305-0000)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Execution Engine</Description>
</module>
<module>
<Timestamp>130411458364015976</Timestamp>
<BaseAddress>0x68fb0000</BaseAddress>
<Size>421888</Size>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Version>4.0.30319.237 (RTMGDR.030319-2300)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Execution Engine</Description>
</module>
<module>
<Timestamp>130411458363676776</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\WINDOWS\SYSTEM32\mpr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411458363753497</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411458363749172</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411458363671912</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\WINDOWS\SYSTEM32\winspool.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411458491103729</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411458363588640</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411458364087300</Timestamp>
<BaseAddress>0x728b0000</BaseAddress>
<Size>53248</Size>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Sort Version Server 2003</Description>
</module>
<module>
<Timestamp>130411458367207856</Timestamp>
<BaseAddress>0x73010000</BaseAddress>
<Size>634880</Size>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411458363918441</Timestamp>
<BaseAddress>0x736a0000</BaseAddress>
<Size>24576</Size>
<Path>C:\WINDOWS\SYSTEM32\shunimpl.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Obsolete APIs</Description>
</module>
<module>
<Timestamp>130411458363737868</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\WINDOWS\SYSTEM32\msacm32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130411458363728312</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\WINDOWS\SYSTEM32\winmm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411458363733368</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411458491228615</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\WINDOWS\SYSTEM32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130411458363758011</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411458491143438</Timestamp>
<BaseAddress>0x74be0000</BaseAddress>
<Size>1638400</Size>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft GDI+</Description>
</module>
<module>
<Timestamp>130411458487262368</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130411458465672332</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\WINDOWS\SYSTEM32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130411458465524567</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\WINDOWS\SYSTEM32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130411458487142278</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130411458363723327</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\WINDOWS\SYSTEM32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411458363744640</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\WINDOWS\SYSTEM32\version.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411458465598809</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130411458363662127</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\WINDOWS\SYSTEM32\userenv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411458363643911</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\WINDOWS\SYSTEM32\sspicli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411458363612766</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411458401793064</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411458487890980</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130411458363667034</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411458363760891</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\WINDOWS\SYSTEM32\cfgmgr32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411458363762120</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\WINDOWS\SYSTEM32\devobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411458363591566</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\WINDOWS\SYSTEM32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458363657169</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\WINDOWS\SYSTEM32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411458363759776</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\WINDOWS\SYSTEM32\setupapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411458363589971</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\WINDOWS\SYSTEM32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458363651009</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\WINDOWS\SYSTEM32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411458363650112</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\WINDOWS\SYSTEM32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411458363767599</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\WINDOWS\SYSTEM32\normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411458363649174</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\WINDOWS\SYSTEM32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411458363691731</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\WINDOWS\SYSTEM32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411458363717156</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411458363653927</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\WINDOWS\SYSTEM32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411458465431190</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\WINDOWS\SYSTEM32\ws2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130411458363644849</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\WINDOWS\SYSTEM32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411458363763341</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\WINDOWS\SYSTEM32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411458363766273</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\WINDOWS\SYSTEM32\wininet.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411458363764869</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\WINDOWS\SYSTEM32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411458363655490</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\WINDOWS\SYSTEM32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411458465433044</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\WINDOWS\SYSTEM32\nsi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130411458363693141</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\WINDOWS\SYSTEM32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411458363647498</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\WINDOWS\SYSTEM32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411458363646129</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\WINDOWS\SYSTEM32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411458363652367</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\WINDOWS\SYSTEM32\shell32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411458363580901</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\WINDOWS\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411458363738946</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\WINDOWS\SYSTEM32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
<module>
<Timestamp>130411458430257106</Timestamp>
<BaseAddress>0x7a440000</BaseAddress>
<Size>7979008</Size>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Version>2.0.50727.5447 (Win7SP1GDR.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>.NET Framework</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>72</ProcessIndex>
<ProcessId>5636</ProcessId>
<ParentProcessId>5520</ParentProcessId>
<ParentProcessIndex>71</ParentProcessIndex>
<AuthenticationId>00000000:00021a24</AuthenticationId>
<CreateTime>130411458493399802</CreateTime>
<FinishTime>130411458526233334</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>High</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>dw20.exe</ProcessName>
<ImagePath>C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</ImagePath>
<CommandLine>dw20.exe -x -s 868</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>2.0.50727.4927 (NetFXspW7.050727-4900)</Version>
<Description>Microsoft .NET Error Reporting Shim</Description>
<modulelist>
<module>
<Timestamp>130411458504030826</Timestamp>
<BaseAddress>0x240000</BaseAddress>
<Size>36864</Size>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Version>2.0.50727.4927 (NetFXspW7.050727-4900)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Error Reporting Shim</Description>
</module>
<module>
<Timestamp>130411458504800790</Timestamp>
<BaseAddress>0x2640000</BaseAddress>
<Size>761856</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130411458493480592</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>36864</Size>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Version>2.0.50727.4927 (NetFXspW7.050727-4900)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Error Reporting Shim</Description>
</module>
<module>
<Timestamp>130411458503729730</Timestamp>
<BaseAddress>0x65100000</BaseAddress>
<Size>2195456</Size>
<Path>C:\WINDOWS\APPPATCH\AcGenral.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130411458503786691</Timestamp>
<BaseAddress>0x671e0000</BaseAddress>
<Size>2461696</Size>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130411458504790338</Timestamp>
<BaseAddress>0x67970000</BaseAddress>
<Size>483328</Size>
<Path>C:\WINDOWS\SYSTEM32\riched20.dll</Path>
<Version>5.31.23.1230</Version>
<Company>Microsoft Corporation</Company>
<Description>Rich Text Edit Control, v3.1</Description>
</module>
<module>
<Timestamp>130411458503682664</Timestamp>
<BaseAddress>0x688c0000</BaseAddress>
<Size>577536</Size>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130411458504482596</Timestamp>
<BaseAddress>0x68d40000</BaseAddress>
<Size>172032</Size>
<Path>C:\WINDOWS\SYSTEM32\werui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting UI DLL</Description>
</module>
<module>
<Timestamp>130411458503717544</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\WINDOWS\SYSTEM32\mpr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130411458503763578</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411458503758345</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130411458503711672</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\WINDOWS\SYSTEM32\winspool.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130411458503210361</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130411458504384120</Timestamp>
<BaseAddress>0x70bd0000</BaseAddress>
<Size>24576</Size>
<Path>C:\WINDOWS\SYSTEM32\SensApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SENS Connectivity API DLL</Description>
</module>
<module>
<Timestamp>130411458504121145</Timestamp>
<BaseAddress>0x728b0000</BaseAddress>
<Size>53248</Size>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Sort Version Server 2003</Description>
</module>
<module>
<Timestamp>130411458503224527</Timestamp>
<BaseAddress>0x73010000</BaseAddress>
<Size>634880</Size>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130411458504295900</Timestamp>
<BaseAddress>0x73630000</BaseAddress>
<Size>397312</Size>
<Path>C:\WINDOWS\SYSTEM32\wer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting DLL</Description>
</module>
<module>
<Timestamp>130411458504038531</Timestamp>
<BaseAddress>0x736a0000</BaseAddress>
<Size>24576</Size>
<Path>C:\WINDOWS\SYSTEM32\shunimpl.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Obsolete APIs</Description>
</module>
<module>
<Timestamp>130411458503752756</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\WINDOWS\SYSTEM32\msacm32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130411458503741047</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\WINDOWS\SYSTEM32\winmm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130411458503747213</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130411458504817215</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\WINDOWS\SYSTEM32\xmllite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130411458503769929</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130411458504781903</Timestamp>
<BaseAddress>0x74af0000</BaseAddress>
<Size>192512</Size>
<Path>C:\WINDOWS\SYSTEM32\duser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUser Engine</Description>
</module>
<module>
<Timestamp>130411458504691530</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\WINDOWS\SYSTEM32\dui70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130411458504771502</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130411458503735197</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\WINDOWS\SYSTEM32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130411458503244705</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\WINDOWS\SYSTEM32\version.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130411458503700249</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\WINDOWS\SYSTEM32\userenv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130411458503688678</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\WINDOWS\SYSTEM32\sspicli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130411458503249006</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130411458504615003</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\WINDOWS\SYSTEM32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130411458503705949</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130411458503772635</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\WINDOWS\SYSTEM32\cfgmgr32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130411458503773861</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\WINDOWS\SYSTEM32\devobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130411458503212705</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\WINDOWS\SYSTEM32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458503694741</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\WINDOWS\SYSTEM32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130411458503771449</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\WINDOWS\SYSTEM32\setupapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130411458503211439</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\WINDOWS\SYSTEM32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130411458503239367</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\WINDOWS\SYSTEM32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130411458503238486</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\WINDOWS\SYSTEM32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130411458503779178</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\WINDOWS\SYSTEM32\normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130411458503237424</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\WINDOWS\SYSTEM32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130411458504204636</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\WINDOWS\SYSTEM32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130411458503231019</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130411458503691537</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\WINDOWS\SYSTEM32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130411458503225616</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\WINDOWS\SYSTEM32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130411458503775068</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\WINDOWS\SYSTEM32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411458503245767</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\WINDOWS\SYSTEM32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130411458503777806</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\WINDOWS\SYSTEM32\wininet.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130411458503776556</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\WINDOWS\SYSTEM32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130411458503693082</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\WINDOWS\SYSTEM32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130411458504205827</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\WINDOWS\SYSTEM32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130411458503235772</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\WINDOWS\SYSTEM32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130411458503233554</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\WINDOWS\SYSTEM32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130411458503689980</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\WINDOWS\SYSTEM32\shell32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130411458493482568</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\WINDOWS\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130411458503227391</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\WINDOWS\SYSTEM32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
</processlist><eventlist>
<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4389199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>Process Start</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Parent PID: 1772, Command line: &quot;C:\Program Files\MKV2AC3\MKV2AC3.exe&quot; , Current directory: C:\Program Files\MKV2AC3\, Environment: 

	=::=::\

	ALLUSERSPROFILE=C:\ProgramData

	AMDAPPSDKROOT=C:\Program Files\AMD APP\

	APPDATA=C:\Users\manono\AppData\Roaming

	CommonProgramFiles=C:\Program Files\Common Files

	COMPUTERNAME=TOM

	ComSpec=C:\Windows\system32\cmd.exe

	FP_NO_HOST_CHECK=NO

	HOMEDRIVE=C:

	HOMEPATH=\Users\manono

	LOCALAPPDATA=C:\Users\manono\AppData\Local

	LOGONSERVER=\\TOM

	NUMBER_OF_PROCESSORS=8

	OS=Windows_NT

	Path=C:\Program Files\AMD APP\bin\x86;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static

	PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

	PROCESSOR_ARCHITECTURE=x86

	PROCESSOR_IDENTIFIER=x86 Family 6 Model 30 Stepping 5, GenuineIntel

	PROCESSOR_LEVEL=6

	PROCESSOR_REVISION=1e05

	ProgramData=C:\ProgramData

	ProgramFiles=C:\Program Files

	PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

	PUBLIC=C:\Users\Public

	SESSIONNAME=Console

	SystemDrive=C:

	SystemRoot=C:\Windows

	TEMP=C:\Users\manono\AppData\Local\Temp

	TMP=C:\Users\manono\AppData\Local\Temp

	USERDOMAIN=tom

	USERNAME=manono

	USERPROFILE=C:\Users\manono

	windir=C:\Windows

	windows_tracing_flags=3

	windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4389213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5360</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4437241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4437386 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x1360000, Image Size: 0xba000</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4437500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ntdll.dll</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4437990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4438146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4438224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4439448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x77d10000, Image Size: 0x13c000</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4440194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4441210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 110,592, EndOfFile: 106,524, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4441275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 106,524, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4441423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 106,524, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4966688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4967068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Write Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4967286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryInformationVolume</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail>VolumeCreationTime: 11/13/2011 6:49:21 AM, VolumeSerialNumber: 2231-FB9D, SupportsObjects: True, VolumeLabel: </Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.4967348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7452461 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\PROGRAM FILES</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7452623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7452685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000003c</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7452744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7452922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7453442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST SOFTWARE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7453593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST SOFTWARE</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7453650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\AVAST SOFTWARE</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0xb00000000b97e</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7453703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\AVAST SOFTWARE</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7453773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST SOFTWARE</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7454248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST SOFTWARE\AVAST</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7454396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7454450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x400000000b980</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7454504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7454692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7455191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7455336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7455393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1a000000013b00</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7455447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7455627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7456121 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7456988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7457050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1a000000013b0e</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7457104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\LANG</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.7457295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8048104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8048667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\USERS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8048826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Users</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8048885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Users</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000163</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8048955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Users</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8049144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Users</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8049643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\MANONO</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8049791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Users\manono</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8049847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Users\manono</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x3000000000033</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8049901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Users\manono</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8050082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Users\manono</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8050575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono\APPDATA</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8050718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Users\manono\AppData</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8050777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Users\manono\AppData</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x200000000016b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8050828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Users\manono\AppData</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8050896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Users\manono\AppData</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8051365 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8051521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8051575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x200000000017e</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8051626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Users\manono\AppData\LOCAL</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8051806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8052292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8052440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8052499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000020b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8052553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8052731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8053232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8053380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8053437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000020f</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8053488 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8053663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8054159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8054321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8054377 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000212</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8054428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8054620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8055116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8055275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8055331 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000217</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8055385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8055590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8056156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8057460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8057522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000244</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8057576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8057641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8058131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8058600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8058659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000245</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8058713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8058899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8659999 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8660608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8661632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8661696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000262</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8661753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.8661985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 98,304, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9111377 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9111975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9112581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9112643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000311</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9112703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9112770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9113269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9113746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9113805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000312</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9113859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9113926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9114408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9114931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9114993 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000003eb</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9115047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9115115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9115600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9116093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9116152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000003ec</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9116206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9116273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9116753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9116917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9116974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000040d</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9117025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9117211 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 40,960, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9584685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9585264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9586358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9586423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000417</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9586480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9586569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9587094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9587482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9587541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000418</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9587595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9587684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9588177 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9589228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9589288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000427</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9589344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9589430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9589934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9591012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9591071 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000042b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9591128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9591193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9591699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9592206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9592268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000042c</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9592324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9592392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9592920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9594003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9594063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000043a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9594116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9594181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9594682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9595184 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9595243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000043b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9595297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9595364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9595857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9596919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9596978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000442</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9597035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9597100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9597601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9598078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9598137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000443</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9598194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9598261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9598768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9600056 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9600123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000452</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9600193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9600263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9600794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9601287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9601346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000453</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9601403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9601470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9601988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9603125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9603184 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000045a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9603241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9603305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9603826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9604300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9604359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000045b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9604413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9604480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9604979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9605359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9605415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000428</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9605469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9605537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9606049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9606200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9606256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\FONTS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000004f5</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9606310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\FONTS</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9606528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9607040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9607202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9607259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000004f6</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9607312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\GLOBALIZATION</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9607380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9607849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9608008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9608064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000510</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9608116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9608183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9608660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9608819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9608875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000005dc</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9608927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:32.9609094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,096, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0049405 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0049968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0050141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0050203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000691</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0050256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0050467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0050981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0051146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0051205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000694</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0051259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0051437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0488905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0489511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0490781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0490845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000006aa</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0490902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0491090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0949133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0949737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0949909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0949971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000006c3</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0950028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.0950243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 98,304, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1386175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1386766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1386930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1386995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000780</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1387057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1387415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1387941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1388097 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1388153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000a54</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1388207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1388466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1389196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1389369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1389428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002245</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1389482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1389552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1390280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1390452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1390525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002293</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1390581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1390651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1391336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1391503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1391562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002299</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1391616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1391689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1392228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1392643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1392710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1392759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000054e5</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1392799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\NTDLL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1392853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,290,240, EndOfFile: 1,288,488, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1392923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1393368 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1393793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1393858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1393904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1800000000ba84</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1393942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1393977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 243,032, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1394033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1394451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1394869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1394933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1394979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052a2</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNEL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 868,352, EndOfFile: 868,352, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004da6</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\APISETSCHEMA.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 8,192, EndOfFile: 6,656, NumberOfLinks: 3, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1395949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1396378 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1396550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1396612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1396658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052a4</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1396696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNELBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1396728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 290,816, EndOfFile: 290,816, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1396790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1397213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1397631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1397695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1397741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005381</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1397779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1397811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 299,008, EndOfFile: 297,808, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1397873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1398288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1398709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1398773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1398816 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052dc</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1398857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\LOCALE.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1398889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 421,888, EndOfFile: 419,880, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1398951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\locale.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1399396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1399560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1399625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1399671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1a000000013b4b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1399711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1399741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 745,472, EndOfFile: 745,472, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1399800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1400228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1400633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1400697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1400743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004daa</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1400781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\APPHELP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1400813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 299,008, EndOfFile: 295,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1400878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1401298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1401700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1401764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\APPPATCH\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1401810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002ec1</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1401848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\SYSMAIN.SDB</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1401880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1401942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1402360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1402775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1402840 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1402883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002eb9</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1402923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1402953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 565,248, EndOfFile: 562,176, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1403015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1403432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1403853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1403917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1403961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005759</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1404001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SSPICLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1404031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 102,400, EndOfFile: 100,352, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1404095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1404516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1404936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1405001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1405047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000053ff</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1405087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSVCRT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1405119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 692,224, EndOfFile: 690,688, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1405181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1405604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1406022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1406087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1406133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005669</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1406173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRT4.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1406205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 655,360, EndOfFile: 653,312, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1406267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1406690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1407130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1407194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1407240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005836</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1407278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\USER32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1407310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 815,104, EndOfFile: 811,520, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1407375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1407792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1408216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1408280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1408323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005119</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1408364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\GDI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1408393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 307,200, EndOfFile: 304,640, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1408458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1408878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1409320 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1409385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1409431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052ee</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1409469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\LPK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1409504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 28,672, EndOfFile: 26,624, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1409566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1409983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1410406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1410468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1410514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000583f</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1410555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\USP10.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1410584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 626,688, EndOfFile: 626,176, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1410646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1411091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1411498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1411562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1411608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056f2</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1411646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHELL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1411678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,873,728, EndOfFile: 12,872,192, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1411740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1412161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1412578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1412643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1412686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056fc</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1412727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHLWAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1412759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 352,256, EndOfFile: 350,208, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1412821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1413239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1413656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1413721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1413767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000552c</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1413804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLE32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1413837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,417,216, EndOfFile: 1,414,144, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1413901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1414327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1414750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1414812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1414858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005534</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1414896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLEAUT32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1414928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 573,440, EndOfFile: 571,904, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1414990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1415408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1415828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1415890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1415952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000583b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1415993 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1416025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 81,920, EndOfFile: 81,920, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1416090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1416510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1416933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1416998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1417041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000055c3</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1417081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\PROFAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1417114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 32,768, EndOfFile: 31,744, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1417178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1417599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1418019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1418081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1418127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000592b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1418167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1418197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 323,584, EndOfFile: 320,000, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1418261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1418679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1419110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1419178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1419223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005360</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1419264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1419299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 65,536, EndOfFile: 64,000, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1419361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1419784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1420204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1420269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1420312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000051aa</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1420353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1420385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 118,784, EndOfFile: 118,272, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1420447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1420865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1421280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1421344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1421387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005386</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1421428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCTF.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1421460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 831,488, EndOfFile: 828,928, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1421525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1421940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1422357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1422422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1422468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002eb8</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1422506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1422538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,179,072, EndOfFile: 2,175,488, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1422597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1423020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1423435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1423500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1423546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056b9</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1423584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SECHOST.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1423616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 94,208, EndOfFile: 92,160, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1423681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1424101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1424521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1424586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1424632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005849</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1424669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\UXTHEME.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1424702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 249,856, EndOfFile: 249,856, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1424764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1425181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1425602 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1425667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1425712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000590e</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1425750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1425782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 196,608, EndOfFile: 194,048, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1425847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1426267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1426691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1426755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1426798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005680</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1426839 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SAMCLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1426871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 53,248, EndOfFile: 51,200, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1426933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1427353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1427774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1427838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1427884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005370</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1427922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1427954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 73,728, EndOfFile: 72,192, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1428019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1428439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1428862 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1428927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1428970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004d6f</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1429011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\ADVAPI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1429043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 643,072, EndOfFile: 640,512, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1429118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1429552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1429997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1430062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1430107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000586b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1430148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1430180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 24,576, EndOfFile: 21,504, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1430245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1430668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1431088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1431153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1431199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056e9</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1431237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1431269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 2,560, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1431334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1431754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1432172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1432234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1432279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056eb</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1432317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC_OS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1432349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 40,960, EndOfFile: 40,960, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1432414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1432829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1433249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1433314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1433357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005061</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1433398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\DWMAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1433430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 69,632, EndOfFile: 67,072, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1433492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1433915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1434335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1434400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1434446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056df</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1434486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SETUPAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1434519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,671,168, EndOfFile: 1,667,584, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1434581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1435017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1435440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1435505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1435551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004e61</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1435591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\CFGMGR32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1435624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 147,456, EndOfFile: 145,920, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1435685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1436106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1436524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1436588 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1436634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004fcc</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1436674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\DEVOBJ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1436704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 65,536, EndOfFile: 64,512, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1436769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1437192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1437612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1437677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1437723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000582f</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1437763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\URLMON.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1437795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,105,920, EndOfFile: 1,102,848, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1437857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1438275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1438690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1438755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1438798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000518e</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1438838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\IERTUTIL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1438871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,794,048, EndOfFile: 1,791,488, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1438935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1439423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1439852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1439916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1439962 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005903</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1440002 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WININET.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1440035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,130,496, EndOfFile: 1,126,912, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1440113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1440541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1440967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1441032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1441078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000054d9</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1441118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\NORMALIZ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1441150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 2,048, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1441212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1441625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1442891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1442959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1443004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002ebc</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1443045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1443077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 212,992, EndOfFile: 211,968, NumberOfLinks: 5, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1443136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1443565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1443988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1444053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1444096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005703</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1444136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1444166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,288, EndOfFile: 10,752, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1444228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1444686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1445133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1445198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1445246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004e9f</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1445287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1445319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1445381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1445807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1446233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1446297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1446343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000043e3</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1446381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1446413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 413,696, EndOfFile: 413,520, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1446475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1446896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1447874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1447938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1447984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000571e</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1448025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1448057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 40,960, EndOfFile: 38,400, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1448119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1448555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1449623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1449690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1449736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000368a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1449776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1449808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,003,520, EndOfFile: 1,000,444, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1449870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1450299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1451053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1451118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1451164 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1a000000013b06</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1451204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1451234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 296, EndOfFile: 292, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1451299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1451743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1452174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1452239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1452285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000041e6</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1452323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1452355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 5,926,912, EndOfFile: 5,924,176, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1452417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1452894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1453355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1453422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1453468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000af07</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1453511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1453543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 634,880, EndOfFile: 632,656, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1453608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1454042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1454637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1454702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1454748 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000431a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1454788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1454818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 28,672, EndOfFile: 26,035, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1454883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1455303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1455481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1455543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1455586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000003689</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1455624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTDEFAULT.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1455656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,945,024, EndOfFile: 2,944,004, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1455718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SortDefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1456173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1456357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1456421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1456464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fb6</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1456508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1456540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 11,493,376, EndOfFile: 11,490,304, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1456605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1457057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1457475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1457540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1457583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000566c</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1457623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCSS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1457656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 376,832, EndOfFile: 376,832, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1457717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1458138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1458310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1458375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1458418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004ecd</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1458459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1458488 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 36,864, EndOfFile: 36,864, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1458553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1458992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1460323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1460391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1460436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052ff</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1460477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1460509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,288, EndOfFile: 9,958, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1460574 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1461016 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1461552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1461619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1461665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002f5a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1461716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1461749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 610,304, EndOfFile: 610,304, NumberOfLinks: 3, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1461813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1462247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1462673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1462738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1462784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000041dc</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1462824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1462854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 364,544, EndOfFile: 363,856, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1462916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1463352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1463533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1463597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1463640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fc0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1463681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1463713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 7,966,720, EndOfFile: 7,963,648, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1463794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1464282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1464899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1464966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1465012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fca</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1465055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1465088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,589,248, EndOfFile: 1,587,200, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1465152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1465621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1466163 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1466230 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1466276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fd7</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1466316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1466349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,435,456, EndOfFile: 12,433,408, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1466416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1466987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1467532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1467596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1467645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fcf</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1467685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1467718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 774,144, EndOfFile: 771,584, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1467782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1468216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WS2_32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1468645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WS2_32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1468709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WS2_32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1468755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WS2_32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005996</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1468795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WS2_32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1468828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WS2_32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 208,896, EndOfFile: 206,848, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1468892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ws2_32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1469369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NSI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1469798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NSI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1469863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NSI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1469908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NSI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000054e0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1469946 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\NSI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1469978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NSI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,288, EndOfFile: 8,704, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1470046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\nsi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1470493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSWSOCK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1470951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSWSOCK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1471016 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSWSOCK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1471062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSWSOCK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005408</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1471099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSWSOCK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1471132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSWSOCK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 233,472, EndOfFile: 232,448, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1471196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1471620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1472043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1472107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1472153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000059b7</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1472194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1472223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,288, EndOfFile: 9,216, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1472288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1472708 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHIP6.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1473137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHIP6.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1473201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHIP6.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1473247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHIP6.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000059ac</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1473285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHIP6.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1473317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHIP6.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,288, EndOfFile: 10,752, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1473379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1473829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1474382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1474449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1474497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fc2</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1474538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1474570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 974,848, EndOfFile: 971,264, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1474635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1475098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1476936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1477004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1477055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fdb</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1477098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1477133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 5,455,872, EndOfFile: 5,453,312, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1477198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1477742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1697609 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1697682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1697728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002eee</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1697771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1697806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 20,480, EndOfFile: 20,320, NumberOfLinks: 9, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1697868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1698307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1699210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1699280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1699328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002eed</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1699369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1699401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 266,240, EndOfFile: 262,148, NumberOfLinks: 9, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1699463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1699905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\TZRES.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1700334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\TZRES.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1700398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\TZRES.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1700441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\TZRES.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005800</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1700482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\TZRES.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1700514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\TZRES.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 2,048, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1700579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1701005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1701425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1701490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1701533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004ed5</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1701573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1701605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 81,920, EndOfFile: 78,848, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1701670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptsp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1702093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RSAENH.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1702511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RSAENH.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1702576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RSAENH.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1702619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RSAENH.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000566f</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1702659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\RSAENH.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1702691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RSAENH.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 242,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1702753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1703195 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1703734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1703802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1703850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fac</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1703891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1703936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 5,025,792, EndOfFile: 5,025,792, NumberOfLinks: 3, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1704001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1704427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1705173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1705238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1705284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1a000000013b34</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1705324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1705357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 20,480, EndOfFile: 20,480, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1705418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1705852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRTREMOTE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1706030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRTREMOTE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1706092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRTREMOTE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1706135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRTREMOTE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000566b</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1706176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRTREMOTE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1706205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRTREMOTE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 49,152, EndOfFile: 46,080, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1706270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1706731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1707175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1707240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1707286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000008601</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1707326 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1707361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,626,112, EndOfFile: 1,624,576, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1707421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1707852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1709272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1709339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: ANCI, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1709385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x4000000000f44</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1709426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1709461 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 94,208, EndOfFile: 94,064, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1709523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1709956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1710382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1710447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1710493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000003582</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1710530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1710563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 700,416, EndOfFile: 700,180, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1710627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Fonts\tahoma.ttf</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1711042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1711460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1711525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1711568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000003585</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1711608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1711641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 651,264, EndOfFile: 648,008, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1711703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Fonts\tahomabd.ttf</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1712153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINDOWSCODECS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1712317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINDOWSCODECS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1712382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINDOWSCODECS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1712427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINDOWSCODECS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000058fd</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1712465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINDOWSCODECS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1712498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINDOWSCODECS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,011,712, EndOfFile: 1,010,688, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1712562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1712985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1713888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1713953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1713998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1a000000013b10</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1714039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1714071 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 1,542, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1714133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1714554 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1715287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1715351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1715397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1a000000013b52</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1715437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1715470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 16,384, EndOfFile: 13,312, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1715532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1715963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1716389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1716453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1716496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000041a7</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1716537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1716567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 24,576, EndOfFile: 23,872, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1716626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1717038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1718555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1718623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1718668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000041e0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1718706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1718738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 344,064, EndOfFile: 342,352, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1718800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1719261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1719698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1719762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1719808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000041ac</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1719846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1719878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 36,864, EndOfFile: 33,096, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1719940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1720358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\SETUPAPI.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1720536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\SETUPAPI.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1720598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\SETUPAPI.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1720641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\SETUPAPI.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000075c0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1720681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\SETUPAPI.DLL.MUI</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1720711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\SETUPAPI.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 53,248, EndOfFile: 49,664, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1720776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\en-US\setupapi.dll.mui</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1721199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\TZRES.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1721369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\TZRES.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1721430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\TZRES.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1721474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\TZRES.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000007660</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1721511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\TZRES.DLL.MUI</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1721544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\TZRES.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 32,768, EndOfFile: 29,184, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1721606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\en-US\tzres.dll.mui</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 704,512, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 192,512, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 38,400, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 942,080, Length: 58,364, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1723939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 292, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 26,035, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 9,958, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 606,208, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1724788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,527,808, Length: 59,392, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1725454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1725540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,043,904, Length: 53,248, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1725605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,097,152, Length: 385,024, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1725688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 3,010,560, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1725750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 3,178,496, Length: 204,800, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1725823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 3,588,096, Length: 372,736, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1725901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,231,168, Length: 188,416, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1725974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,665,344, Length: 397,312, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,279,744, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,537,792, Length: 65,536, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,754,880, Length: 61,440, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 7,434,240, Length: 258,048, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 9,039,872, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 10,014,720, Length: 315,392, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 10,792,960, Length: 73,728, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 12,025,856, Length: 407,552, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726647 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 745,472, Length: 26,112, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1726901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 942,080, Length: 29,184, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1727084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1727165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,283,840, Length: 169,472, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1727267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 20,320, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1727415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1727531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1727612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,021,696, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1727739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 20,480, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1727868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 94,064, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1727952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 1,542, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1728065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 13,312, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1728165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1728286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 172,032, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.1728391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 28,672, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6709264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6709533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6709886 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6709975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6710094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6710180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6710353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6710509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6710652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6710738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6710821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\TZRES.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6710983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6711067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6711209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6711374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6711465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6711584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\SETUPAPI.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6711727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\EN-US\TZRES.DLL.MUI</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6711878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\NTDLL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNEL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\APISETSCHEMA.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNELBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6712837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6713389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6713462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6713683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6713745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\APPHELP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6713861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6713928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6714230 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6714300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SSPICLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6714416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6714481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSVCRT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6714599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6714664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRT4.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6714783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6714850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\USER32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6714969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\GDI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\LPK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715378 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\USP10.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHELL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHLWAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6715944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLE32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716073 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLEAUT32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\PROFAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6716941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6717003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6717114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6717176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCTF.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6717297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6717359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SECHOST.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\UXTHEME.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SAMCLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6718903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\ADVAPI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC_OS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6719981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\DWMAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SETUPAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\CFGMGR32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\DEVOBJ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\URLMON.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6720883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\IERTUTIL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6721018 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6721080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WININET.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6721207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6721269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\NORMALIZ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6721377 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6721439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6721466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 212,992, EndOfFile: 211,968, NumberOfLinks: 5, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6723074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6723158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6723303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6723371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6723481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6723546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6724209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6724279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6724308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 40,960, EndOfFile: 38,400, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6724610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6724686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6727009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6727138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6727254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6727324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6728803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6728919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6729038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6729100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6729129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 610,304, EndOfFile: 610,304, NumberOfLinks: 3, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6729269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,096, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6912548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6912639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6912842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6912914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6913084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6913165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6913192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,589,248, EndOfFile: 1,587,200, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.6913362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 253,952, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.7159855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.7159966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.7159996 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,435,456, EndOfFile: 12,433,408, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.7160631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,761,280, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.7784690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.7784889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.7784919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 774,144, EndOfFile: 771,584, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.7785081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 94,208, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8138237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8138336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WS2_32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8138474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ws2_32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8138544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\NSI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8138660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\nsi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8138722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSWSOCK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8138838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8138902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8139010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8139075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHIP6.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8139183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8139247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8139274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 974,848, EndOfFile: 971,264, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8139468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 118,784, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8344566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8344663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8344692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 5,455,872, EndOfFile: 5,453,312, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8344981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 548,864, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8693788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8693893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8694025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptsp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8694092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\RSAENH.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8694235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8694300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8694329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 5,025,792, EndOfFile: 5,025,792, NumberOfLinks: 3, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.8694620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,096, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9119828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9119925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9119954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 20,480, EndOfFile: 20,480, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9120086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,096, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9297576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9297660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRTREMOTE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9297792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9297862 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINDOWSCODECS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 16,384, EndOfFile: 13,312, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298676 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9298778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9301166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 103,424, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9301600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,096, Length: 184,320, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9301686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 454,656, Length: 278,528, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9301923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,536, Length: 428,032, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 429,568, Length: 34,304, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 463,872, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 210,432, Length: 73,728, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,024, Length: 184,320, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 186,368, Length: 6,144, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 192,512, Length: 1,024, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 50,176, Length: 81,920, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,024, Length: 33,280, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 34,304, Length: 1,024, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9302707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 35,328, Length: 1,536, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9304704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,024, Length: 2,007,040, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9304914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,069,504, Length: 241,664, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9304992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,442,240, Length: 1,388,544, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,035,584, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,187,136, Length: 20,480, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,338,688, Length: 61,440, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,641,792, Length: 249,856, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,182,464, Length: 434,176, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305539 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,616,640, Length: 512, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,617,152, Length: 68,608, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,685,760, Length: 2,048, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 139,264, Length: 28,672, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 323,584, Length: 45,056, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9305900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 544,768, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9308202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 512, Length: 1,511,424, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9308382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,568,256, Length: 118,784, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9308447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,692,672, Length: 368,640, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9308530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,065,408, Length: 958,464, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9308657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 3,769,344, Length: 380,928, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9308738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,170,752, Length: 331,776, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9308821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,731,904, Length: 589,824, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9308924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,477,376, Length: 319,488, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 6,374,400, Length: 90,112, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 6,820,864, Length: 237,568, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 7,427,072, Length: 24,576, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 7,599,104, Length: 180,224, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 7,934,976, Length: 8,192, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 8,303,616, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 8,737,792, Length: 315,392, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 9,323,520, Length: 266,240, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,096, Length: 577,536, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9309969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 585,728, Length: 20,480, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9310174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,024, Length: 349,184, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9310274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 350,208, Length: 1,024, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9310355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 351,232, Length: 2,048, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9311557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 512, Length: 831,488, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9311729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 984,576, Length: 106,496, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9311802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,097,216, Length: 671,744, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9311950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,022,912, Length: 40,960, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,067,968, Length: 503,808, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,731,520, Length: 1,110,016, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,406,784, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,820,480, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,119,488, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,328,384, Length: 184,320, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,717,504, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,942,784, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 6,139,392, Length: 118,784, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 6,282,752, Length: 77,824, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9312950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 6,532,608, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9313023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 6,680,064, Length: 45,056, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9313098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 7,690,752, Length: 512, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9313473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 512, Length: 200,704, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9313567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 214,528, Length: 40,960, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9313640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 256,512, Length: 520,192, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9313750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,067,520, Length: 61,440, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9313820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,288,704, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9313890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,530,880, Length: 512, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9315690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 512, Length: 442,368, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9315847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 696,832, Length: 634,880, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9315992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,520,128, Length: 237,568, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9316089 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,761,280, Length: 307,200, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9316202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,068,480, Length: 458,752, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9316332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 3,010,560, Length: 12,288, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9316410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 3,178,496, Length: 204,800, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9316504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 3,588,096, Length: 372,736, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9316617 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,231,168, Length: 188,416, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9316717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,665,344, Length: 618,496, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9316865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,537,792, Length: 65,536, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9316946 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,754,880, Length: 61,440, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317024 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 7,434,240, Length: 258,048, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317121 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 9,039,872, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 10,014,720, Length: 315,392, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 10,629,120, Length: 237,568, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 12,026,880, Length: 1,536, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 512, Length: 73,728, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 87,040, Length: 8,192, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 95,744, Length: 167,936, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 402,944, Length: 57,344, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9317986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 595,456, Length: 53,248, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318056 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 747,520, Length: 512, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 512, Length: 53,248, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318258 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 108,032, Length: 12,288, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318326 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 121,344, Length: 159,744, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 428,544, Length: 65,536, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 715,264, Length: 122,880, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 942,080, Length: 512, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318843 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 512, Length: 73,728, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 512,000, Length: 12,288, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9318991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 548,864, Length: 217,088, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 958,464, Length: 106,496, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,699,840, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,777,088, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,286,912, Length: 512, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,702,208, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,096, Length: 8,192, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 16,384, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 160,768, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 668,672, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,094,656, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,024, Length: 8,704, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9319994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 12,800, Length: 512, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9320102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9320177 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 13,824, Length: 512, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9320247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 14,336, Length: 2,048, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:33.9320328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 24,576, Length: 2,560, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7911080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7911361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7911522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7911670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7911811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7911961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7912061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7912204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7912350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7912433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7912597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7912740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7912883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7913020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7913158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7913317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7913460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7913600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7913740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7913880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7914023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7914179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7914325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7914462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7914602 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7914753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7914899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7914982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7915117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7915276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7915419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7915559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7915696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7915836 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7915990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7916133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7916273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7916432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7916572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7916710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7916847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7916987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7917141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7917278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7917418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7917502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7917588 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7917750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7917839 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7917933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORWKS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORJIT.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7918852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WS2_32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7919005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\NSI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7919146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSWSOCK.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7919286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7919442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHIP6.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7919585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7919671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7919755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7919924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RSAENH.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7920078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7920167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7920245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RPCRTREMOTE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7920385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7920536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINDOWSCODECS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7920673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7920757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CULTURE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7920838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7920943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>CloseFile</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7921264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5360, User Time: 0.0000000, Kernel Time: 0.0468003</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7923298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7923471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ntdll.dll</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7923608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\apisetschema.dll</Detail>
</event>

<event>
<ProcessIndex>67</ProcessIndex>
<Time_of_Day>6:30:34.7924139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5356</PID>
<Operation>Process Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Exit Status: -1073740756, User Time: 0.0000000 seconds, Kernel Time: 0.0468003 seconds, Private Bytes: 229,376, Peak Private Bytes: 229,376, Working Set: 155,648, Peak Working Set: 155,648</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3483142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Process Start</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Parent PID: 1772, Command line: &quot;C:\Program Files\MKV2AC3\MKV2AC3.exe&quot; , Current directory: C:\Program Files\MKV2AC3\, Environment: 

	ALLUSERSPROFILE=C:\ProgramData

	AMDAPPSDKROOT=C:\Program Files\AMD APP\

	APPDATA=C:\Users\manono\AppData\Roaming

	CommonProgramFiles=C:\Program Files\Common Files

	COMPUTERNAME=TOM

	ComSpec=C:\Windows\system32\cmd.exe

	FP_NO_HOST_CHECK=NO

	HOMEDRIVE=C:

	HOMEPATH=\Users\manono

	LOCALAPPDATA=C:\Users\manono\AppData\Local

	LOGONSERVER=\\TOM

	NUMBER_OF_PROCESSORS=8

	OS=Windows_NT

	Path=C:\Program Files\AMD APP\bin\x86;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static

	PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

	PROCESSOR_ARCHITECTURE=x86

	PROCESSOR_IDENTIFIER=x86 Family 6 Model 30 Stepping 5, GenuineIntel

	PROCESSOR_LEVEL=6

	PROCESSOR_REVISION=1e05

	ProgramData=C:\ProgramData

	ProgramFiles=C:\Program Files

	PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

	PUBLIC=C:\Users\Public

	SystemDrive=C:

	SystemRoot=C:\Windows

	TEMP=C:\Users\manono\AppData\Local\Temp

	TMP=C:\Users\manono\AppData\Local\Temp

	USERDOMAIN=tom

	USERNAME=manono

	USERPROFILE=C:\Users\manono

	windir=C:\Windows

	windows_tracing_flags=3

	windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3483152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5524</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3578726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3578885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0xbe0000, Image Size: 0xba000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3578990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ntdll.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3579499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3579674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3579758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3580901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x77d10000, Image Size: 0x13c000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3581709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3581865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 118,784, EndOfFile: 115,492, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3581927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 115,492, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3582841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3583291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3583382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3583598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\CWDIllegalInDLLSearch</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3583655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3584471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3585579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3585861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/1/2014 12:01:38 PM, LastAccessTime: 1/22/2014 4:51:28 AM, LastWriteTime: 1/22/2014 4:51:28 AM, ChangeTime: 4/1/2014 12:07:43 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3585915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3586581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3586859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3586991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3587128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3588640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x70b90000, Image Size: 0x3f000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3588801 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3589971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x763e0000, Image Size: 0xd4000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3591566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76160000, Image Size: 0x4a000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3593248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3593830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:08 AM, LastAccessTime: 11/20/2010 11:29:08 AM, LastWriteTime: 11/20/2010 11:29:08 AM, ChangeTime: 11/13/2011 6:56:29 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3593870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3594393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3594945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3595083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3595686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3596745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x68a40000, Image Size: 0x4a000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3596872 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3600866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3600984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3601186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\(Default)</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 36, Data: 00060101.00060101</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3601720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3601817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3601992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 16</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3602725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3602830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3603110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters\BehavShield</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3603172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3603323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3603418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3603682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters\HookList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3603779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3606670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value, Set Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3606783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value, Set Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3606875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Srp\GP\DLL</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3606948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Srp\GP\DLL</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3607028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3607220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 80</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3607274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3607505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3609004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3609664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:13 AM, LastAccessTime: 11/20/2010 11:29:13 AM, LastWriteTime: 11/20/2010 11:29:13 AM, ChangeTime: 11/13/2011 6:56:12 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3609720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3610529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3611313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3611499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3611747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3612766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75de0000, Image Size: 0x4c000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3612898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3614302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3615088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3615363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3615449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3615490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3615560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3615654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3615967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3616161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\ShowDebugInfo</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 256</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3616209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3616754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3617029 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QuerySecurityFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Information: Owner, Group, DACL, SACL, Label</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3617115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3617204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QuerySecurityFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Information: Owner, Group, DACL, SACL, Label</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3617250 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3617328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3619082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3619246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3619298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3620049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3620308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3, 1: MKV2AC3</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3620583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3621337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3621556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3.exe, 1: MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3621750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3622019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3622200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 146, Data: C:\Users\manono\AppData\Local\Microsoft\Windows\Temporary Internet Files</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3622262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3622305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3622450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 40, Data: WINXPSP2 RUNASADMIN</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3622499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3622585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3622709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3622744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3623496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3623658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3623693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3624188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3624372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3, 1: MKV2AC3</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3624555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3625064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3625253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3.exe, 1: MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3625436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3625668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3625827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 146, Data: C:\Users\manono\AppData\Local\Microsoft\Windows\Temporary Internet Files</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3625878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3625921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3626040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 40, Data: WINXPSP2 RUNASADMIN</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3626080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3626150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3626269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3626301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3630755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3630920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached\MachineLanguageConfiguration</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3630990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\MUI\Settings</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Policies\Microsoft\Control Panel\Desktop</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Control Panel\Desktop\LanguageConfiguration</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKCU\Control Panel\Desktop\LanguageConfiguration</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 512</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Control Panel\Desktop\LanguageConfiguration</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\MUI\Settings</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Policies\Microsoft\Control Panel\Desktop</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Control Panel\Desktop</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Control Panel\Desktop\PreferredUILanguages</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 12</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Control Panel\Desktop</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\MUI\Settings</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3631995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3632097 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3632186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 12</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3632224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_MULTI_SZ, Length: 12, Data: en-US</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3632275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3632356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3633092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3633833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3633970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3634849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3635245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:07 AM, LastAccessTime: 11/20/2010 11:29:07 AM, LastWriteTime: 11/20/2010 11:29:07 AM, ChangeTime: 11/13/2011 6:53:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3635280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3635749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3636212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3636325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3637309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3639282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x688c0000, Image Size: 0x8d000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3639387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3640540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\SspiCli.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3641470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3641930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:19 AM, LastAccessTime: 11/20/2010 11:29:19 AM, LastWriteTime: 11/20/2010 11:29:19 AM, ChangeTime: 11/13/2011 6:56:57 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3641965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3642472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3642957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3643078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SspiCli.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3643240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3643911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75dc0000, Image Size: 0x1b000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3643992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3644849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x767c0000, Image Size: 0xac000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3646129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x77010000, Image Size: 0xa1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3647498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76f40000, Image Size: 0xc9000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3649174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76610000, Image Size: 0x4e000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3650112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76560000, Image Size: 0xa000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3651009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x764c0000, Image Size: 0x9d000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3652367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x770c0000, Image Size: 0xc4a000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3653927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x766a0000, Image Size: 0x57000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3655490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76cd0000, Image Size: 0x15c000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3657169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x761b0000, Image Size: 0x8f000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3658578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\USERENV.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3659395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3659823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:13 AM, LastAccessTime: 11/20/2010 11:29:13 AM, LastWriteTime: 11/20/2010 11:29:13 AM, ChangeTime: 11/13/2011 6:56:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3659861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3660462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3661168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3661314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3661470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3662127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75b20000, Image Size: 0x17000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3662319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3663836 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\profapi.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3664666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3665075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:12:02 PM, LastAccessTime: 7/13/2009 1:12:02 PM, LastWriteTime: 7/13/2009 3:16:12 PM, ChangeTime: 11/13/2011 6:56:51 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3665110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3665598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3666072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3666194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3666336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3667034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75eb0000, Image Size: 0xb000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3667134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3668568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\WINSPOOL.DRV</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3669443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3669877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:57:02 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3669915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3670435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3670953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3671074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3671227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3671912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x70a60000, Image Size: 0x51000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3672082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3673518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MPR.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3674337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3674757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:55:36 PM, LastAccessTime: 7/13/2009 1:55:36 PM, LastWriteTime: 7/13/2009 3:15:41 PM, ChangeTime: 11/13/2011 6:56:26 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3674793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3675299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3675779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3675927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3676078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3676776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x70570000, Image Size: 0x12000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3676851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3679880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3680292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:20 AM, LastAccessTime: 11/20/2010 11:29:20 AM, LastWriteTime: 11/20/2010 11:29:20 AM, ChangeTime: 11/13/2011 6:56:23 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3680327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3680829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3681537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3681661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3681696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 118,784, EndOfFile: 118,272, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3681772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3681985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3682990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3683426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:20 AM, LastAccessTime: 11/20/2010 11:29:20 AM, LastWriteTime: 11/20/2010 11:29:20 AM, ChangeTime: 11/13/2011 6:56:23 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3683461 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3684006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3684582 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3684693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3684728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 118,784, EndOfFile: 118,272, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3684793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3684970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3685881 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3686283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:20 AM, LastAccessTime: 11/20/2010 11:29:20 AM, LastWriteTime: 11/20/2010 11:29:20 AM, ChangeTime: 11/13/2011 6:56:23 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3686315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3686787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3687256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3687369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3687514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3691731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76660000, Image Size: 0x1f000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3691834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3693141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76e40000, Image Size: 0xcc000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3694351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Error Message Instrument\</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3694440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Error Message Instrument</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3694499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3694655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3694693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3694909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3695049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32\MKV2AC3</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 172</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3695086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3695124 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3695992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3696129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3696232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3696302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\RequireSignedAppInit_DLLs</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3696337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3696374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3698304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\OLE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3698471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole\PageAllocatorUseSystemHeap</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3698514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3698549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\OLE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3698654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole\PageAllocatorSystemHeapIsPrivate</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3698689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3698835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\OLE\Tracing</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3699331 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\OLEAUT</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3699490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\OLEAUT</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3700797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\system\CurrentControlSet\control\NetworkProvider\HwOrder</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3700872 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\control\NetworkProvider\HwOrder</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3702726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3703348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3703470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3705299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3705984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3706092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3707202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3707789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3707894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3708679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3709277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3709379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3710204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3710589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:07 AM, LastAccessTime: 11/20/2010 11:29:07 AM, LastWriteTime: 11/20/2010 11:29:07 AM, ChangeTime: 11/13/2011 6:53:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3710624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3711123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3711632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3711751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3712581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3713349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x65100000, Image Size: 0x218000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3713451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3714599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3715014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:11:59 PM, LastAccessTime: 7/13/2009 1:11:59 PM, LastWriteTime: 7/13/2009 3:16:13 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3715052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3715604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3716102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3716226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3716394 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3717156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76680000, Image Size: 0x19000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3718423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3719967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\UxTheme.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3720805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3721225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:40:46 PM, LastAccessTime: 7/13/2009 1:40:46 PM, LastWriteTime: 7/13/2009 3:16:17 PM, ChangeTime: 11/13/2011 6:56:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3721276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3721853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3722338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3722459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\UxTheme.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3722605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3723327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x758e0000, Image Size: 0x40000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3723427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3724974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\WINMM.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3725795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3726245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:18 AM, LastAccessTime: 11/20/2010 11:29:18 AM, LastWriteTime: 11/20/2010 11:29:18 AM, ChangeTime: 11/13/2011 6:57:02 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3726283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3726806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3727307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3727431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3727579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3728312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x742a0000, Image Size: 0x32000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3728396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3729770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\samcli.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3730619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3731236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:06 AM, LastAccessTime: 11/20/2010 11:29:06 AM, LastWriteTime: 11/20/2010 11:29:06 AM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3731293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3731918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3732411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3732532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3732675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3733368 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x74600000, Image Size: 0xf000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3733465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3734731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MSACM32.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3735558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3735971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 2:03:29 PM, LastAccessTime: 7/13/2009 2:03:29 PM, LastWriteTime: 7/13/2009 3:15:42 PM, ChangeTime: 11/13/2011 6:56:29 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3736006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3736493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3736970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3737086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3737232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3737868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x73ff0000, Image Size: 0x14000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3737949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3738946 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x77e50000, Image Size: 0xa0000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3740883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\VERSION.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3742276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3742697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:41:45 PM, LastAccessTime: 7/13/2009 1:41:45 PM, LastWriteTime: 7/13/2009 3:16:17 PM, ChangeTime: 11/13/2011 6:56:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3742732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3743219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3743694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3743812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3743955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3744640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75a10000, Image Size: 0x9000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3744734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3745963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\sfc.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3746790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3747202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:15:36 PM, LastAccessTime: 7/13/2009 1:15:36 PM, LastWriteTime: 7/13/2009 3:10:22 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3747237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3747722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3748199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3748318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3748458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3749172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x70800000, Image Size: 0x3000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3749248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3750263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\sfc_os.DLL</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3751115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3751525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:15:41 PM, LastAccessTime: 7/13/2009 1:15:41 PM, LastWriteTime: 7/13/2009 3:16:14 PM, ChangeTime: 11/13/2011 6:56:54 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3751560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3752047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3752524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3752640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3752780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3753497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x707f0000, Image Size: 0xd000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3753583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3754788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\dwmapi.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3755610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3756022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:24:17 PM, LastAccessTime: 7/13/2009 1:24:17 PM, LastWriteTime: 7/13/2009 3:15:13 PM, ChangeTime: 11/13/2011 6:56:18 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3756057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3756542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3757014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3757132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3757278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3758011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x74a50000, Image Size: 0x13000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3758404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3759776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76240000, Image Size: 0x19d000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3760891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75f30000, Image Size: 0x27000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3762120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75f60000, Image Size: 0x12000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3763341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76870000, Image Size: 0x110000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3764869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76b10000, Image Size: 0x1b8000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3766273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x769f0000, Image Size: 0x11a000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3767599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76600000, Image Size: 0x3000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3769671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3771544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\Windows Error Reporting\WMR</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3771721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3771767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3771864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 34, Data: %SystemRoot%\inf</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\CustomLocale</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\CustomLocale</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\CustomLocale\en-US</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 532</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\CustomLocale</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale\en-US</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 532</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3772867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3775241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3888675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3888791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3889879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3890542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3890650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3891768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3892205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:26:53 PM, LastAccessTime: 7/13/2009 1:26:53 PM, LastWriteTime: 7/13/2009 3:14:52 PM, ChangeTime: 3/23/2014 6:33:47 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3892245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3892792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3893283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3893407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3893981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3894431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x671e0000, Image Size: 0x259000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3894520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3897117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3897743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3897864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3898734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3899327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3899432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3900292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3900922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3901033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3901830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3902415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3902518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3903329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3903922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3904027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3904730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3905328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3905444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3906411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3907015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3907120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3907403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3907624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection\KnownDllList</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 16</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3907670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection\KnownDllList</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 22, Data: nlhtml.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3907718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3908392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3909015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3909117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3909869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3910122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3910330 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3912157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x19d0000, Image Size: 0xba000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3912229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3912399 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3912437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3912903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Manifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3913086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3914991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\SHUNIMPL.DLL</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3915821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3916282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:55 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3916317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3916824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3917322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3917446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3917635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3918441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x736a0000, Image Size: 0x6000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3918519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3919009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3919858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3921192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3921362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:18 AM, LastAccessTime: 11/20/2010 11:29:18 AM, LastWriteTime: 11/20/2010 11:29:18 AM, ChangeTime: 11/13/2011 6:58:45 AM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3921402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3922076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3923229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3923407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3923445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3924008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3924426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3924550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3924590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3924655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3924814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3925789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3926007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3926051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3926608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3927018 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3927153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3927193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3927255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3927414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3928476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3928662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3928705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3929265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3929672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3929793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3929829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3929904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3930058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3931084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3931257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3931294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3932019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3932453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3932580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3932618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3932682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3932833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3933854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3934032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3934081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3934641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3935067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3935186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3935223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3935283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3935431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3936422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3936598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3936635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3937185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3937592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3937719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3937756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3937821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3937980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3938945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3939115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3939150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3939675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3940079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3940198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3940233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3940295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3940459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3941710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3941890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3941928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3942491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3942949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3943089 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3943127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3943192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3943356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3944561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3944746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3944784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3945355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3945776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3945897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3945935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3946000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3946150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3947244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3947487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3947527 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3948109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3948511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3948630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3948667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3948729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3948875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3949920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3950106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3950141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3950713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3951287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3951427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3951467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3951540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3951688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3952690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3952866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3952906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3953469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3953882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3954016 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3954067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3954135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3954278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3955269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3955444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3955480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3956013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3956412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3956528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3956565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3956627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3956781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3957773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3957951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3957986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3958546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3958950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3959069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3959109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3959174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3959355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3960411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3960583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3960621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3961473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3962098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3962273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3962338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3962497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3962680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3963736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3963925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3963965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3964534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3964949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3965073 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3965110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3965178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3965334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3966361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3966533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3966568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3967096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3967493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3967608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3967646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3967705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3967848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3968813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3968988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3969023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3969570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3969972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3970088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3970123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3970185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3970330 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3971319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3971494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3971529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3972087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3972505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3972642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3972701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3972782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3972931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3973987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3974170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3974205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3974758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3975162 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3975280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3975318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3975380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3975534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3976641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3976830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3976870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3977439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3977865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3977988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3978040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3978104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3978253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3979201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3979371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3979406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3979948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3980349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3980465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3980503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3980573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3980734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3981729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3981901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3981939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3982505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3982925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3983041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3983076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3983138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3983281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3984235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3984410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3984445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3984997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3985404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3985523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3985558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3985625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3985779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3986771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3986940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3986978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3987501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3987897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3988013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3988048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3988107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3988250 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3989212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3989382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3989436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3990120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3990532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3990651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3990689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3990761 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3990907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3995954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3996644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\System</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3997021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\System\wing.dll</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: wing.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3997951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\System</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3998582 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\System32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3998781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\SYSTEM32\wing.dll</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: wing.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.3999657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4000179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\System</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4000365 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\System\wing32.dll</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: wing32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4000581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\System</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4001233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\System32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4001427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\SYSTEM32\wing32.dll</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: wing32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4001589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4005620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\Policy\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4005903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Query: Cached, SubKeys: 5, Values: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4005970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 4, Name: v4.0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4006043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 3, Name: v2.0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4006078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 2, Name: Upgrades</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4006111 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 1, Name: Standards</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4006143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: AppPatch</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4006226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4006380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0</Path>
<Result>SUCCESS</Result>
<Detail>Query: Cached, SubKeys: 0, Values: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4006450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: 30319, Type: REG_SZ, Length: 24, Data: 30319-30319</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4006534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4007337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4007595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4007803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4007878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4007913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4008382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4008765 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Filter: mscoreei.dll, 1: mscoreei.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4009905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4010080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4010217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4010379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4010425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4010457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4010934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4011133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Filter: mscoreei.dll, 1: mscoreei.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4011346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4011562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4011721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4011767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4011799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4012616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4012788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 5/17/2011 6:27:52 AM, LastAccessTime: 10/10/2011 5:31:18 AM, LastWriteTime: 5/17/2011 6:27:52 AM, ChangeTime: 11/30/2011 11:57:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4012823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4013314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4013548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4013696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4014470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4015976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x68fb0000, Image Size: 0x67000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4016081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4017525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4017709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4017746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4018285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4018692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4018816 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4018851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4018913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4019072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4020037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4020207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4020244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4020783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4021201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4021317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4021352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4021414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4021557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4022492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4022659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4022697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4023225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4023642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4023758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4023793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4023855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4023998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4024952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4025135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4025170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4025742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4026143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4026259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4026294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4026353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4026496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4027415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4027582 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4027620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4028143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4028541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4028660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4028695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4028754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4028911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4029875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4030042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4030080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4030614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4031029 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4031147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4031182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4031241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4031392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4032341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4032508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4032546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4033071 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4033467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4033594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4033629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4033691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4033831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4034772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4034941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4034979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4035507 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4035909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4036025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4036060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4036122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4036262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4037226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4037396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4037445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4037967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4038361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4038477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4038512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4038574 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4038714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4039660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4039830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4039865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4040404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4040818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4040937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4040972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4041034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4041185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4042158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4042325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4042363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4042896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4043295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4043414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4043449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4043508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4043651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4044580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4044750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4044785 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4045329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4045728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4045855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4045890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4045952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4046111 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4047057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4047227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4047262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4047800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4048199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4048315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4048350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4048412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4048555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4049495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4049663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4049700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4050255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4050654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4050789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4050824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4050886 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4051026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4051958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4052144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4052179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4052705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4053104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4053220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4053255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4053317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4053459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4054403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4054572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4054607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4055149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4055548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4055664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4055699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4055761 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4055901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4056849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4057019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4057057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4057590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4057989 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4058105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4058154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4058213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4058356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4059280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4059447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4059482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4060008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4060404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4060517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4060552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4060614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4060786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4061808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4061983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4062018 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4062578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4062985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4063104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4063142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4063203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4063352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4064327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4064497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4064548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4065087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4065491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4065623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4065658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4065720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4065863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4066787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4066955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4066992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4067526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4067927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4068041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4068076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4068138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4068280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4069218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4069385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4069420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4069946 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4070342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4070458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4070493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4070549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4070762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4071740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4071910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4071945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4072484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4072883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4073012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4073050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4073109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4073249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4074195 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4074818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4074855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4075405 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4075807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4075923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4075958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4076020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4076162 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4077114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4077283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4077321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4077874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4078286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4078402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4078439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4078499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4078639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4079571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4079738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4079773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4080296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4080698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4080827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4080862 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4080924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4081067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4082274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\000000FF.000000FF</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 50, Data: SortServer2003Compat.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4083163 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\SortServer2003Compat.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4083969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\SortServer2003Compat.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4084769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4084934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:15:47 PM, LastAccessTime: 7/13/2009 1:15:47 PM, LastWriteTime: 7/13/2009 3:16:14 PM, ChangeTime: 11/13/2011 6:56:55 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4084971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4085467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4085702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4085823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SortServer2003Compat.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4086041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4087300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x728b0000, Image Size: 0xd000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4087402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4088669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4088849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4088887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4089426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4089973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4090108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4090148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4090215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4090374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4091436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4091611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4091649 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4092204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4092606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4092727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4092765 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4092829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4092977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4093961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4094147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4094185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4094710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4095117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4095236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4095273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4095335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4095484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4096451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4096621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4096658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4097189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4097591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4097709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4097744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4097809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4097952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4098900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4099070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4099108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4099685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4100086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4100202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4100240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4100304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4100471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4101420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4101592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4101630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4102169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4102571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4102689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4102727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4102789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4102934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4103883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4104053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4104093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4104621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4105034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4105149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4105187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4105249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4105395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4106349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4106518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4106556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4107098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4107510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4107629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4107666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4107739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4107893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4108833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4109019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4109057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4109585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4109984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4110102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4110137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4110202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4110345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4111452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4111644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4111681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4112220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4112627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4112746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4112784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4112851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4113021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4113972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4114142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4114179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4114708 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4115106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4115225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4115260 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4115325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4115470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4116411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4116580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4116621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4117179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4117580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4117710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4117747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4117812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4117957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4118906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4119076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4119113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4119652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4120049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4120167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4120205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4120270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4120412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4121377 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4121549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4121601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4122134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4122536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4122652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4122689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4122751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4122897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4123870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4124037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4124074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4124619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4125020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4125139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4125174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4125239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4125384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4126349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4126516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4126554 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4127079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4127483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4127599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4127637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4127699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4127844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4128787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4128957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4128995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4129537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4129954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4130084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4130119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4130183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4130329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4131299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4131471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4131509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4132037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4132439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4132557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4132592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4132657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4132805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4133751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4133921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4133959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4134508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4134923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4135039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4135077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4135139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4135295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4136255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4136424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4136462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4136998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4137400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4137518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4137556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4137618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4137766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4138709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4138879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4138917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4139445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4139841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4139960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4139995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4140057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4140213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4141213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4141388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4141426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4141975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4142374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4142493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4142541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4142606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4142752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4143697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4143867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4143905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4144452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4144851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4144969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4145004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4145069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4145214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4146155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4146325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4146362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4146926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4147346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4147465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4147502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4147564 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4147710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4148672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4148844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4148879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4149410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4149809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4149928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4149963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4150027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4150175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4151151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4151323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4151361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4151895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4152294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4152412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4152450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4152512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4152657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4153557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4153913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4154255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SortServer2003Compat.nls</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4154296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,003,520, EndOfFile: 1,000,444, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4154360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4154452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4155374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4155589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4155654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4156608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4156845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4157009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4157060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4157098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4157618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4157990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\*</Path>
<Result>SUCCESS</Result>
<Detail>Filter: *, 1: .</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4159057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK</Path>
<Result>SUCCESS</Result>
<Detail>0: .., 1: NETFXSBS10.exe, 2: netfxsbs12.hkf, 3: sbscmp10.dll, 4: sbscmp20_mscorwks.dll, 5: sbscmp20_perfcounter.dll, 6: sbs_diasymreader.dll, 7: sbs_iehost.dll, 8: sbs_microsoft.jscript.dll, 9: sbs_microsoft.vsa.vb.codedomprocessor.dll, 10: sbs_mscordbi.dll, 11: sbs_mscorrc.dll, 12: sbs_mscorsec.dll, 13: sbs_system.configuration.install.dll, 14: sbs_system.data.dll, 15: sbs_system.enterpriseservices.dll, 16: sbs_VsaVb7rt.dll, 17: sbs_wminet_utils.dll, 18: SharedReg12.dll, 19: v1.0.3705, 20: v1.1.4322, 21: v2.0.50727, 22: v3.0, 23: v3.5, 24: v4.0.30319</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4160213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v1.0.3705\clr.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.4160391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\$Directory</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7002613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v1.0.3705\mscorwks.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7003796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v1.1.4322\clr.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7004510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v1.1.4322\mscorwks.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7005098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\clr.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7005629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7006143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7006895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7159077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7159300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK</Path>
<Result>NO MORE FILES</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7159430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7160351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7160723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7161208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 292</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7161701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 292, Length: 8,175</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7161928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7162149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7162367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7162415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7162534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7162688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7162725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7163216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7163488 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 745,472, EndOfFile: 745,472, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7163555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7163590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 745,472, EndOfFile: 745,472, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7163668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7163911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7164630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7164889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 745,472, EndOfFile: 745,472, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7164954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7164986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 745,472, EndOfFile: 745,472, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7165040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7165231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7165646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7165808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework\Policy\Standards</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7165948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\Policy\Standards</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7166131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\Standards\v2.0.50727</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7166191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\Standards</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7166425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7166598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NoClientChecks</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7166635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7167169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7167657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7168662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7169074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:30 AM, LastAccessTime: 10/11/2011 7:10:30 AM, LastWriteTime: 7/8/2011 12:33:43 PM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7169112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7169610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7170103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7170254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7177775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7178603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x63ac0000, Image Size: 0x5ab000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7178697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7179001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7179177 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7179217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7179662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7180303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7180408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:30 AM, LastAccessTime: 10/11/2011 7:10:30 AM, LastWriteTime: 7/8/2011 12:33:43 PM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7201680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7202068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7202914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7204181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7204353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:10 AM, LastAccessTime: 11/20/2010 11:29:10 AM, LastWriteTime: 11/20/2010 11:29:10 AM, ChangeTime: 11/13/2011 6:58:45 AM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7204391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7205057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7206094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7206275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:07 AM, LastAccessTime: 11/20/2010 11:29:07 AM, LastWriteTime: 11/20/2010 11:29:07 AM, ChangeTime: 11/13/2011 6:58:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7206334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7206889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7207156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7207312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7207463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7207856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x73010000, Image Size: 0x9b000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7207937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7210371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7210551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7210589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7211171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7211580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7211707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7211745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7211812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7211979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7213006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7213181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7213219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7213766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7214189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7214308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7214353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7214418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7214569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7215539 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7215711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7215749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7216326 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7216735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7216854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7216892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7216954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7217099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7218080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7218266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7218304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7218859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7219266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7219384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7219422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7219487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7219643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7220608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7220783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7220821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7221397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7221804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7221920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7221958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7222023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7222168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7223146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7223319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7223354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7223933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7224345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7224464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7224504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7224569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7224733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7225701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7225876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7225914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7226458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7226865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7226983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7227021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7227091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7227248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7228228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7228401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7228436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7228991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7229395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7229514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7229552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7229614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7229762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7230767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7230964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7231004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7231556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7231969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7232090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7232130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7232192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7232359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7233480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7233666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7233707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7234265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7234685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7234812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7234863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7234930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7235097 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7236113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7236288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7236329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7236878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7237296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7237415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7237452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7237517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7237665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7238660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7238832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7238870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7239436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7239843 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7239961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7239996 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7240058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7240204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7241260 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7241441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7241478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7242020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7242432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7242551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7242586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7242651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7242796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7243793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7243968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7244006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7244569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7244982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7245100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7245140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7245205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7245375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7246402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7246579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7246628 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7247191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7247601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7247722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7247760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7247851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7248010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7249013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7249188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7249228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7249778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7250180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7250298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7250336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7250409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7250554 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7251570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7251748 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7251786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7252349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7252758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7252877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7252912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7252979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7253133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7254092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7254292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7254329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7254879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7255291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7255410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7255448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7255510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7255658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7256671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7256854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7256892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7257442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7257860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7257994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7258032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7258094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7258240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7259242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7259414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7259452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7260037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7260441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7260560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7260595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7260659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7260824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7261850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7262023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7262061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7262616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7263017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7263136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7263171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7263236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7263381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7264397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7264577 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7264615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7265181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7265591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7265712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7265771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7265841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7265990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7266952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7267127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7267162 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7267703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7268113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7268232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7268275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7268339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7268493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7269746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7269929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7269970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7270514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7271034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7271166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7271209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7271274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7271425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7272433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7272619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7272659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7273206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7273613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7273731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7273766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7273842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7273987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7274933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7275103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7275141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7275677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7276079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7276211 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7276248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7276310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7276467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7279716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7279900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:07 AM, LastAccessTime: 11/20/2010 11:29:07 AM, LastWriteTime: 11/20/2010 11:29:07 AM, ChangeTime: 11/13/2011 6:58:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7279945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7280226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7280439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Filter: Windows, 1: Windows</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7280646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7281201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7281403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\WinSxS</Path>
<Result>SUCCESS</Result>
<Detail>Filter: WinSxS, 1: winsxs</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7281894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7282613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7282826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.dll</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MSVCR80.dll, 1: msvcr80.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7283659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7284532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7284645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7284828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\GCStressStart</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7284871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7284963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\GCStressStartAtJit</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\GCStressStart</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\GCStressStartAtJit</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7285895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7286491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7286593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7286755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7286795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7286863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7286933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7287076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: InstallRoot, Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7287157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 1, Length: 220</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7287965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\WMI\Security\e13c0d23-ccbc-4e12-931b-d9cc2eee27e4</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 524</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7289223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\WMI\Security\cc2bcbba-16b6-4cf3-8990-d74c2e8af500</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 524</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7290115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\Policy\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7291212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7291382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:28:49 AM, LastAccessTime: 4/4/2014 2:45:25 PM, LastWriteTime: 4/4/2014 2:45:25 PM, ChangeTime: 4/4/2014 2:45:25 PM, AllocationSize: 98304, EndOfFile: 98304, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7291420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7291638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7291824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7291897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7291980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7292581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7292950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7293432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,095</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7294233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,095, Length: 6,304</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7294812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 10,399, Length: 4,191</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7295203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 14,590, Length: 4,106</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7295567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 18,696, Length: 4,111</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7295944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7296610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7296965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7297272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 292</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7297704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 292, Length: 8,175</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7297887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7298493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7298814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MKV2AC3.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7299690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\fusion.localgac</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7299948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\CacheLocation</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Fusion</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\EnableLog</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\LoggingLevel</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\ForceLog</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\LogFailures</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\VersioningLog</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\LogResourceBinds</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\DisableMSIPeek</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NoClientChecks</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7300891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7301005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7301172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7301204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7304699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5528</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7305222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7306895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: Internet</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets</Path>
<Result>SUCCESS</Result>
<Detail>Index: 1, Name: LocalIntranet</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 2, Length: 288</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: MediaPermission</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet</Path>
<Result>SUCCESS</Result>
<Detail>Index: 1, Name: WebBrowserPermission</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 2, Length: 288</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: MediaPermission</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet</Path>
<Result>SUCCESS</Result>
<Detail>Index: 1, Name: WebBrowserPermission</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7307992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 2, Length: 288</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7308046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7308097 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7308140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7308744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\security.config</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7309345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\security.config.cch</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7309924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\enterprisesec.config</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7310442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\enterprisesec.config.cch</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7310932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3445944825-1449241978-1670914055-1000</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7311145 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3445944825-1449241978-1670914055-1000</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7311584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7311932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312163 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Category</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Name</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 16, Data: AppData</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParentFolder</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Description</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\RelativePath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 32, Data: AppData\Roaming</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParsingName</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InfoTip</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalizedName</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Icon</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Security</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResource</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResourceType</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalRedirectOnly</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Roamable</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PreCreate</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Stream</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PublishExpandedPath</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Attributes</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\FolderTypeID</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InitFolderHandler</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PropertyBag</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7312964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7313222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7313417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7313570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7313624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7313699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7313848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7313982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7314028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 60, Data: %USERPROFILE%\AppData\Roaming</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7314651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\sortdefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7315020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\sortdefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7315284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\sortdefault.nls</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7315324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\sortdefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,945,024, EndOfFile: 2,944,004, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7315400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SortDefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7315500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\SORTING\sortdefault.nls</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7316095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7316246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Windows\Explorer</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7316359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Policies\Microsoft\Windows\Explorer</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7316470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7316712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7316887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7316925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 2</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7316974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 16, Data: Profile</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PropertyBag</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7317720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7318105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3445944825-1449241978-1670914055-1000</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7318302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3445944825-1449241978-1670914055-1000\ProfileImagePath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 32, Data: C:\Users\manono</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7318348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3445944825-1449241978-1670914055-1000\ProfileImagePath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 32, Data: C:\Users\manono</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7318394 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3445944825-1449241978-1670914055-1000</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7319013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono</Path>
<Result>NAME COLLISION</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7319800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7319951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Users\manono</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/12/2011 3:40:16 PM, LastAccessTime: 4/1/2014 12:01:20 PM, LastWriteTime: 4/1/2014 12:01:20 PM, ChangeTime: 4/1/2014 12:01:20 PM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7319986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Users\manono</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7320153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\KnownFolderSettings</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7320250 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\KnownFolderSettings</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7320762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono\AppData\Roaming</Path>
<Result>NAME COLLISION</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Open Reparse Point, Attributes: N, ShareMode: Read, Write, AllocationSize: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7321555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono\AppData\Roaming</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7321700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Users\manono\AppData\Roaming</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/12/2011 3:40:16 PM, LastAccessTime: 4/3/2014 2:04:52 PM, LastWriteTime: 4/3/2014 2:04:52 PM, ChangeTime: 4/3/2014 2:04:52 PM, FileAttributes: DNCI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7321735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Users\manono\AppData\Roaming</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7322649 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7323034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7323314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7324193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5532</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7324936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7325174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 556</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7325322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7325481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 556</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7325990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\index22c.dat</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7696198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index22c</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7696457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index22c\NIUsageMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 22, Data: FF DF FF FF FF FF FF FF FF FF FF FF DF B6 F7 97</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7696538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index22c\ILUsageMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 22, Data: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7696586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index22c</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7696713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7696834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: 8</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 1, Length: 288</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 70, Data: mscorlib,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: A1 A8 2D B6 8B 3B AD C7 C2 7E A1 F6 57 9D 22 C5</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7697998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698230 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 20, Data: C5 E2 50 79 A5 60 6B 73 08 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\NIDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\736b60a5\8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\736b60a5\8\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 70, Data: mscorlib,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\736b60a5\8\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 8198</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\736b60a5\8\Modules</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\736b60a5\8\Modules</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 288, Data: sortkey.nlp|sorttbls.nlp|big5.nlp|bopomofo.nlp|ksc.nlp|prc.nlp|prcp.nlp|xjis.nlp|normidna.nlp|normnfc.nlp|normnfd.nlp|normnfkc.nlp|normnfkd.nlp</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7698977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\736b60a5\8\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: AD 7F DD B2 3E F3 3A 48 8E 08 5D 9B 09 C1 F0 FB</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7699022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\736b60a5\8\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 88 14 B1 17 BF 3D CC 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7699068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\736b60a5\8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7699351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCreateKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\GACChangeNotification\Default</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access, Disposition: REG_OPENED_EXISTING_KEY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7699572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 88 14 B1 17 BF 3D CC 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7702450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7702633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:13:33 AM, LastAccessTime: 10/11/2011 7:13:33 AM, LastWriteTime: 10/11/2011 7:13:33 AM, ChangeTime: 11/13/2011 6:54:05 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7702671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7703194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7703447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7704172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7704579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:36.7704657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1693942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1702848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1703494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x62560000, Image Size: 0xaf8000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1703724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1704966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1705187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1705227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1705828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1706257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1706407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1706448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1706537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1706717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1707682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1707855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1707892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1708455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1708857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1708976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1709013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1709081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1709226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1710202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1710374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1710412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1710945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1711341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1711460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1711498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1711562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1711716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1712700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1712877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1712915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1713486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1713893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1714028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1714063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1714128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1714276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1715257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1715427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1715464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1716001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1716424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1716542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1716583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1716645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1716806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1717814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1717992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1718030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1718609 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1719019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1719159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1719199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1719261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1719409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1720366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1720544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1720584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1721123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1721528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1721660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1721711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1721778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1721926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1722905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1723077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1723115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1723662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1724063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1724182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1724220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1724284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1724430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1725397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1725567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1725602 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1726141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1726545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1726661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1726699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1726763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1726909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1727849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1728019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1728054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1728590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1729005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1729121 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1729159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1729234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1729380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1730347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1730520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1730557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1731078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1731474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1731592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1731627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1731692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1731837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1732810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1732983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1733023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1733559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1733964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1734082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1734120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1734182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1734335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1735298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1735481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1735521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1736047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1736448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1736567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1736604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1736680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1736831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1737779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1737952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1737990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1738528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1738927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1739046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1739084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1739148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1739291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1740240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1740409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1740447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1741005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1741412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1741530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1741565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1741630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1741786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1742754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1742926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1742964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1743508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1743915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1744071 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1744115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1744179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1744327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1745303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1745484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1745521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1746074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1746483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1746605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1746642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1746710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1746855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1747833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1748006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1748044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1748574 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1748976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1749094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1749132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1749197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1749342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1750304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1750474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1750512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1751040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1751439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1751557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1751592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1751660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1751813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1752810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1752983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1753023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1753573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1753975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1754104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1754142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1754206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1754352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1755298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1755467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1755508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1756039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1756438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1756556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1756591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1756656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1756812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1757755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1757925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1757974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1758531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1758936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1759051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1759089 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1759154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1759299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1760251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1760420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1760458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1760984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1761385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1761504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1761541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1761606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1761749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1762716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1762889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1762926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1763460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1763859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1763977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1764015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1764080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1764223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1765209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1765379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1765416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1765945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1766346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1766473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1766510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1766575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1766721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1767656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1767825 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1767863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1768391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1768790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1768909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1768944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1769008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1769154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1771318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1771714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\mscorlib.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: mscorlib.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1773452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1775524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1775697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1775732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1776252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1776459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3, 1: MKV2AC3</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1776672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1777190 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1777381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3.exe, 1: MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1777586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1778518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1778677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1778712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1778949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1779141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>Filter: Program Files, 1: Program Files</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1779340 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1780674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ole32.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1781784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1782194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1782229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1782754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1783339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1783457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1783495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 376,832, EndOfFile: 376,832, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1783565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1783751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1784627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1785028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1785064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1785532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1786096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1786203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1786238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 376,832, EndOfFile: 376,832, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1786306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1786473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1787526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CRYPTBASE.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1788324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CRYPTBASE.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1789116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1789281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:12:01 PM, LastAccessTime: 7/13/2009 1:12:01 PM, LastWriteTime: 7/13/2009 3:15:07 PM, ChangeTime: 11/13/2011 6:56:15 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1789316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1789804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1790030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1790148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1790291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1793064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75e30000, Image Size: 0xc000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1793129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1794535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1794713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1794751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1795317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1795724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1795845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1795883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1795947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1796093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1797039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1797209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1797246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1797777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1798176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1798319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1798357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1798421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1798575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1799523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1799693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1799731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1800272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1800693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1800811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1800846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1800908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1801054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1802005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1802178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1802226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1802770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1803175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1803293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1803328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1803393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1803538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1804517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1804692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1804730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1805263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1805665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1805783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1805818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1805883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1806036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1807036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1807206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1807244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1807769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1808171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1808292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1808327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1808394 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1808545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1809521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1809707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1809747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1810275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1810674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1810801 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1810838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1810900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1811043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1812000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1812172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1812210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1812771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1813191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1813310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1813347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1813409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1813555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1814493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1814660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1814697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1815236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1815635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1815751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1815789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1815851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1815996 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1816934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1817104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1817141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1817672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1818068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1818187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1818222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1818287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1818429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1819392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1819561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1819599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1820130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1820529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1820647 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1820682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1820747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1820901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1821857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1822027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1822078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1822631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1823037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1823167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1823205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1823267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1823409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1824390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1824560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1824598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1825137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1825538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1825654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1825689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1825754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1825897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1826848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1827018 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1827066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1827597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1827998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1828117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1828152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1828217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1828360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1829319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1829491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1829526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1830084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1830480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1830599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1830637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1830699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1830844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1831779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1831949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1831987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1832509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1832927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1833046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1833083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1833145 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1833291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1834247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1834417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1834455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1834986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1835385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1835511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1835549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1835611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1835754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1836735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1836904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1836942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1837465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1837864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1837982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1838017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1838082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1838225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1839176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1839343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1839381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1839923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1840321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1840437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1840472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1840534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1840696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1841655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1841822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1841860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1842399 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1842817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1842935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1842973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1843038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1843191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1844142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1844310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1844345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1844889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1845288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1845406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1845441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1845506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1845660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1846608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1846778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1846816 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1847355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1847761 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1847891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1847939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1848001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1848147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1849095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1849262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1849300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1849826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1850222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1850338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1850375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1850437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1850580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1851534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1851701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1851739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1852278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1852693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1852811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1852849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1852911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1853057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1854037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1854207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1854245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1854770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1855169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1855285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1855323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1855385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1855530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1856492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1856662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1856697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1857223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1857619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1857737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1857772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1857834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1857980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1861955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\l_intl.nls</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1862585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\l_intl.nls</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1862941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\l_intl.nls</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,288, EndOfFile: 9,958, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1863011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\l_intl.nls</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1863049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\l_intl.nls</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,288, EndOfFile: 9,958, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1863116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\L_INTL.NLS</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1863224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\l_intl.nls</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1864485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\Policy\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1865555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1865719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:28:49 AM, LastAccessTime: 4/4/2014 2:45:25 PM, LastWriteTime: 4/4/2014 2:45:25 PM, ChangeTime: 4/4/2014 2:45:25 PM, AllocationSize: 98304, EndOfFile: 98304, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1865759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1865959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1866126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1866191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1866255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Category</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Name</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 12, Data: Cache</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\ParentFolder</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 78, Data: {F1B32785-6FBA-4FCF-9D55-7B8E7F157091}</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Description</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\RelativePath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 86, Data: Microsoft\Windows\Temporary Internet Files</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\ParsingName</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867840 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\InfoTip</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\LocalizedName</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Icon</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Security</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\StreamResource</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1867983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\StreamResourceType</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\LocalRedirectOnly</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Roamable</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PreCreate</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Stream</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PublishExpandedPath</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Attributes</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\FolderTypeID</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\InitFolderHandler</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PropertyBag</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868513 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1868993 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1869131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1869174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1869246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1869279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Cache</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 142, Data: %USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1869904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1871502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\Microsoft\Windows\Temporary Internet Files</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1871674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\Microsoft\Windows\Temporary Internet Files</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/12/2011 3:40:16 PM, LastAccessTime: 4/1/2014 9:59:59 AM, LastWriteTime: 4/1/2014 9:59:59 AM, ChangeTime: 4/1/2014 9:59:59 AM, FileAttributes: HSDNCI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1871712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\Microsoft\Windows\Temporary Internet Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1873345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1873512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 2/23/2007 6:15:02 PM, LastAccessTime: 4/2/2014 12:00:52 PM, LastWriteTime: 2/23/2007 6:15:02 PM, ChangeTime: 4/2/2014 12:00:52 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1873547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1874560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1874717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, AllocationSize: 745472, EndOfFile: 745472, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1874754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1875132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1875328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 556</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1875382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1875549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\a43ba77\19470c78</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1875913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\NET Framework Setup\DotNetClient\v3.5</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1876460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1876660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: MKV2AC3.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1876821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1879823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1880068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 745,472, EndOfFile: 745,472, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1880136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1880171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 745,472, EndOfFile: 745,472, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1880233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1880694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\StrongName</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1881289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1882238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\PublisherPolicy\Default</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1882464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1882981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\pubpol4.dat</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1884566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index4</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 1, Data: FF</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1884666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 00 00 00 00 00 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1885927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC\PublisherPolicy.tme</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.1886113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\$Directory</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2119470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2119634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 2/23/2007 6:15:02 PM, LastAccessTime: 4/2/2014 12:00:52 PM, LastWriteTime: 2/23/2007 6:15:02 PM, ChangeTime: 4/2/2014 12:00:52 PM, AllocationSize: 296, EndOfFile: 292, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2119672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2120265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2120610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2121006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 292</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2121466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 292, Length: 8,175</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2121669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2122655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2122830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 4:05:26 PM, LastAccessTime: 7/13/2009 4:05:26 PM, LastWriteTime: 7/13/2009 6:42:28 PM, ChangeTime: 11/13/2011 6:55:42 AM, AllocationSize: 28672, EndOfFile: 26035, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2122868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2123458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2123808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2124145 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,095</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2124935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,095, Length: 6,304</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2125592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 10,399, Length: 4,191</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2126042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 14,590, Length: 4,106</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2126460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 18,696, Length: 4,111</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2126848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2127392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2127691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2128389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\GAC_32\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2129362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__b03f5f7f11d50a3a</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2129526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 4:37:06 PM, LastAccessTime: 11/20/2010 11:34:34 AM, LastWriteTime: 11/20/2010 11:34:34 AM, ChangeTime: 11/13/2011 6:58:43 AM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2129564 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2130416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2130583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:19 AM, LastAccessTime: 11/20/2010 11:29:19 AM, LastWriteTime: 11/20/2010 11:29:19 AM, ChangeTime: 11/13/2011 6:54:02 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2130637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2131326 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2131693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2131884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2132305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2132776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x67140000, Image Size: 0x9a000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2133097 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x970000, Image Size: 0x9a000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2134479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__b03f5f7f11d50a3a</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2134886 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: Microsoft.VisualBasic.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2136306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2139138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2139521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2139677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryInformationVolume</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>VolumeCreationTime: 11/13/2011 6:49:21 AM, VolumeSerialNumber: 2231-FB9D, SupportsObjects: True, VolumeLabel: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2139737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryAllInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>CreationTime: 11/20/2010 11:29:19 AM, LastAccessTime: 11/20/2010 11:29:19 AM, LastWriteTime: 11/20/2010 11:29:19 AM, ChangeTime: 11/13/2011 6:54:02 AM, FileAttributes: A, AllocationSize: 610,304, EndOfFile: 610,304, NumberOfLinks: 3, DeletePending: False, Directory: False, IndexNumber: 0x1000000002f5a, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2139799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryInformationVolume</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>VolumeCreationTime: 11/13/2011 6:49:21 AM, VolumeSerialNumber: 2231-FB9D, SupportsObjects: True, VolumeLabel: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2139839 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryAllInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>CreationTime: 11/20/2010 11:29:19 AM, LastAccessTime: 11/20/2010 11:29:19 AM, LastWriteTime: 11/20/2010 11:29:19 AM, ChangeTime: 11/13/2011 6:54:02 AM, FileAttributes: A, AllocationSize: 610,304, EndOfFile: 610,304, NumberOfLinks: 3, DeletePending: False, Directory: False, IndexNumber: 0x1000000002f5a, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2140720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2140887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:19 AM, LastAccessTime: 11/20/2010 11:29:19 AM, LastWriteTime: 11/20/2010 11:29:19 AM, ChangeTime: 11/13/2011 6:54:02 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2140928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2141440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2141682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2141804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2141960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2142342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x67140000, Image Size: 0x9a000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2142561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2143671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2143857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2143895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2144463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2144873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2144999 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2145040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2145107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2145264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2146236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2146409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2146460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2146988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2147390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2147508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2147546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2147611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2147759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2148713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2148899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2148936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2149467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2149869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2149987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2150025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2150090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2150235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2151208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2151378 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2151413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2151968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2152367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2152485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2152520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2152601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2152763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2153711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2153884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2153938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2154474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2154873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2155005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2155043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2155107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2155253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2156261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2156433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2156474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2157037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2157446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2157565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2157603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2157670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2157818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2158794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2158969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2159009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2159583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2160022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2160144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2160200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2160276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2160429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2161418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2161591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2161631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2162351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2162798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2162927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2162968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2163035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2163191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2164159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2164331 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2164372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2164957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2165369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2165506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2165547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2165614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2165778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2166810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2166986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2167026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2167587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2168708 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2168853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2168893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2168985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2169141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2170165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2170351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2170392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2170936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2171340 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2171470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2171507 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2171575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2171731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2172777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2172957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2172998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2173558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2173973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2174110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2174151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2174216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2174369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2175374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2175547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2175590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2176140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2176563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2176687 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2176741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2176819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2176988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2177953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2178123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2178161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2178691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2179090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2179209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2179247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2179325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2179473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2180435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2180605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2180642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2181176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2181578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2181693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2181731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2181798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2181947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2182949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2183122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2183159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2183723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2184121 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2184240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2184278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2184342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2184491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2185450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2185622 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2185663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2186188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2186587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2186706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2186743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2186808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2186956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2187932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2188115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2188153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2188683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2189098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2189217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2189255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2189322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2189468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2190416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2190586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2190624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2191155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2191551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2191669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2191707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2191785 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2191944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2192936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2193108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2193146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2193682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2194100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2194218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2194256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2194321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2194480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2195458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2195628 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2195666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2196204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2196603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2196722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2196760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2196824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2196972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2197943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2198112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2198150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2198684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2199088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2199206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2199244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2199309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2199454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2200446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2200616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2200653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2201192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2201591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2201710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2201747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2201815 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2201960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2202930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2203103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2203141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2203688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2204092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2204210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2204248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2204313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2204472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2205431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2205598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2205639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2206186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2206587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2206706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2206743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2206808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2206956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2207918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2208088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2208126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2208659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2209069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2209188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2209223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2209301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2209449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2209891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2216835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2217266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:18:58 AM, LastAccessTime: 10/10/2011 5:18:58 AM, LastWriteTime: 3/29/2011 12:33:48 PM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2217304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2217797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2218277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2218422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2219312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2220101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x68310000, Image Size: 0x5b000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2220190 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2220487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2220678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2220716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2221149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2221750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2221855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:18:58 AM, LastAccessTime: 10/10/2011 5:18:58 AM, LastWriteTime: 3/29/2011 12:33:48 PM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2242502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2242939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2243807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2245011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2245176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:10 AM, LastAccessTime: 11/20/2010 11:29:10 AM, LastWriteTime: 11/20/2010 11:29:10 AM, ChangeTime: 11/13/2011 6:58:45 AM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2245216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2245887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2247054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2247226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2247264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2247803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2248929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2249061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2249102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2249169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2249325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2250306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2250495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2250535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2251074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2251476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2251594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2251632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2251710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2251872 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2252939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2253125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2253165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2253739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2254165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2254289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2254335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2254424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2254575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2255564 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2255739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2255785 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2256388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2256798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2256919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2256957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2257024 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2257175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2258202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2258380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2258420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2258962 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2259366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2259490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2259528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2259595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2259743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2260740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2260913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2260950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2261481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2261880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2261999 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2262036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2262101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2262249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2263276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2263454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2263492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2264025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2264440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2264559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2264596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2264661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2264807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2265755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2265925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2265963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2266515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2266919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2267038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2267075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2267140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2267299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2268264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2268450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2268488 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2269037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2269450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2269568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2269606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2269673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2269819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2270759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2270929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2270967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2271498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2271891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2272010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2272047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2272115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2272274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2273276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2273446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2273486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2274033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2274432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2274551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2274588 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2274653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2274801 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2275771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2275938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2275979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2276510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2276906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2277038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2277076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2277140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2277286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2278245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2278415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2278455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2278983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2279382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2279501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2279539 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2279606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2279751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2280754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2280926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2280975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2281506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2281902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2282020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2282058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2282123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2282271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2283244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2283416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2283454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2283985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2284386 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2284505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2284543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2284607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2284769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2285728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2285901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2285938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2286486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2286884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2287003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2287041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2287105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2287264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2288216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2288385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2288426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2288975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2289385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2289504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2289541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2289606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2289762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2290714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2290883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2290921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2291465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2291864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2291983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2292020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2292085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2292233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2293236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2293419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2293457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2293988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2294384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2294502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2294543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2294607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2294756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2295715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2295885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2295922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2296456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2296852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2296971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2297006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2297070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2297248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2298234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2298404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2298445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2298976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2299372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2299490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2299528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2299595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2299744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2300689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2300862 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2300900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2301430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2301827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2301956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2301994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2302061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2302206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2303212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2303384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2303422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2303972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2304373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2304492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2304532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2304597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2304742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2305685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2305855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2305906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2306451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2306847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2306965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2307003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2307068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2307216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2308178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2308348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2308388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2308935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2309334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2309453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2309490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2309555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2309701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2310673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2310843 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2310881 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2311412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2311810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2311929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2311964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2312031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2312188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2315044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2315338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2315580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: 15</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2315637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064</Path>
<Result>SUCCESS</Result>
<Detail>Index: 1, Name: 32</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2315672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 2, Length: 288</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2315737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2315809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2315928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 94, Data: System.Windows.Forms,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: 6E 59 2E 42 4A 20 4A AF EA DB E2 2B 6B 31 B9 DB</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\ILDependencies</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 140, Data: 40 CE 5D 47 E6 2C 38 2D 0E 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\NIDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 60, Data: C6 38 19 18 C5 E2 50 79 08 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2316982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\15</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\e</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\e\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 84, Data: System.Security,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\e\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\e\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\e\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 3E 52 09 A2 CF 90 02 4D BE EB 2C 9C 51 69 53 93</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\e\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 0E 26 A5 F9 F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317539 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\e</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\4</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\4\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: System.Xml,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2317995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\4\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\4\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318073 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\4\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 03 A9 6C 04 DC F7 2A 49 A6 65 B2 94 6A EA F7 9A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\4\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 76 2E 83 F4 F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\4</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\1f</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\1f\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 80, Data: Accessibility,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\1f\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318609 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\1f\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\1f\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 5D B6 34 95 E5 2C E4 46 B8 72 CF AD DD 49 AA 9F</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\1f\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 1C D7 00 96 11 EA C9 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\1f</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2318860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\3\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 94, Data: System.Configuration,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319164 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\3\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\3\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\3\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: CD 27 8A 3A D5 D4 E6 4D 99 57 EA 80 14 8F 9A 0D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\3\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 22 8D AA FE F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\12</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\12\DisplayName</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\12\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 142, Data: System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\12\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\12\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\12\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 65 E2 7A 89 57 22 A6 40 B4 9E F5 18 CE 8E D0 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\12\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 3C 2C DE AC 11 EA C9 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2319989 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\12</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\1e</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\1e\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 88, Data: System.Deployment,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\1e\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\1e\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\1e\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 2B E4 87 68 80 96 A0 49 B8 4C DF CE 9C 35 86 BE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\1e\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: E0 44 9C FE F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\1e</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\591b6ebf\b</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320881 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\591b6ebf\b\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 94, Data: System.Windows.Forms,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2320967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\591b6ebf\b\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\591b6ebf\b\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\591b6ebf\b\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 2E 02 86 3C A8 D9 03 41 AE 56 E3 C8 13 70 B1 09</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\591b6ebf\b\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 15 E0 C0 61 61 EE CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\591b6ebf\b</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: System,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: AB AB 08 AF A6 0A 6F 06 BD DE 0F CC 96 49 C3 79</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 60, Data: D8 D4 4B 42 7B 32 83 1C 03 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5\NIDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 20, Data: C6 38 19 18 C5 E2 50 79 08 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2321937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\5</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2322085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7b2a17f0\5</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2322269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7b2a17f0\5\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: System,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2322358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7b2a17f0\5\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2322401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7b2a17f0\5\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2322436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7b2a17f0\5\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 95 83 F5 C2 82 E5 12 4E 8A 2E DA E4 4F 26 E5 BB</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2322476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7b2a17f0\5\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: AE CB 64 2D AB 0A CC 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2322517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\7b2a17f0\5</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2322802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2322999 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: System.Drawing,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: 3B 2C FD 85 52 8A 27 EB 71 DC 41 D8 06 73 59 A1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 20, Data: C0 D4 C7 6D DB D4 5C 0A 0F 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\NIDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 40, Data: C6 38 19 18 C5 E2 50 79 08 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\f</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\f</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\f\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: System.Drawing,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\f\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\f\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\f\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: AE C5 87 1D 1E DA 85 48 B4 6B 49 C3 1E BC DD 1F</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2323966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\f\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: B2 5B DF FA F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2324009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\f</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2324796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 15 E0 C0 61 61 EE CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2325236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2325419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: B2 5B DF FA F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2325783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2325955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: AE CB 64 2D AB 0A CC 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2326243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2326410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 76 2E 83 F4 F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2326707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2326882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 22 8D AA FE F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2328084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2328286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:13:37 AM, LastAccessTime: 10/11/2011 7:13:37 AM, LastWriteTime: 10/11/2011 7:13:37 AM, ChangeTime: 11/13/2011 6:54:08 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2328329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2328852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2329105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2329792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2330199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:40.2330277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0254718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0256542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0257106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x7a440000, Image Size: 0x79c000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0257337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0258491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0258695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0258739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0259334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0259760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0259903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0259946 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0260021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0260199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0261167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0261342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0261382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0261935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0262339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0262460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0262500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0262570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0262727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0263705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0263880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0263921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0264505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0264912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0265033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0265074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0265144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0265306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0266289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0266462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0266502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0267044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0267443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0267561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0267601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0267685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0267847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0268793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0268965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0269005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0269542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0269943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0270064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0270105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0270186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0270337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0271390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0271630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0271681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0272277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0272695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0272818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0272859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0272942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0273096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0274085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0274357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0274400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0275069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0275502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0275675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0275726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0275812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0275979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0277009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0277189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0277230 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0277796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0278219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0278348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0278388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0278475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0278704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0279695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0279876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0279916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0280458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0280868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0280994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0281037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0281107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0281261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0282236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0282422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0282463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0283010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0283414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0283535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0283576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0283646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0283797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0284775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0284947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0284988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0285524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0285926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0286047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0286085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0286155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0286327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0287316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0287491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0287532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0288065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0288469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0288591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0288631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0288701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0288852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0289830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0290000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0290040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0290577 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0290981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0291113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0291153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0291221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0291385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0292342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0292514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0292555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0293142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0293544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0293665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0293705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0293775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0293926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0294921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0295096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0295147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0295680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0296085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0296206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0296244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0296316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0296467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0297410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0297586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0297626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0298160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0298564 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0298682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0298723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0298793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0298944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0299919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0300094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0300135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0300690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0301097 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0301232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0301272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0301342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0301493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0302444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0302617 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0302660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0303193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0303598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0303730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0303767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0303837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0304004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0304999 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0305174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0305214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0305751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0306155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0306276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0306316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0306387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0306537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0307683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0307869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0307925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0308486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0308903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0309033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0309073 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0309146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0309305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0310275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0310450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0310491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0311046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0311453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0311574 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0311614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0311684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0311851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0312822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0312997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0313037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0313590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0314007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0314134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0314174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0314244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0314406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0315368 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0315543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0315581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0316117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0316524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0316653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0316694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0316764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0316915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0317893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0318065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0318106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0318658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0319062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0319184 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0319221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0319292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0319445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0320407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0320580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0320631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0321167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0321571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0321693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0321733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0321814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0321973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0322943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0323118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0323158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0323697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0324118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0324242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0324282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0324355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0324517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0326551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\System.Drawing.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0326734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:13:49 AM, LastAccessTime: 10/11/2011 7:13:49 AM, LastWriteTime: 10/11/2011 7:13:49 AM, ChangeTime: 11/13/2011 6:54:09 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0326775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0327303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\System.Drawing.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.0327556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7829298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7831535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7832187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x64490000, Image Size: 0x188000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7832422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7833696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7833922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7833968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7834607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7835041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7835192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7835235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7835310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7835494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7836485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7836660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7836703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7837242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7837649 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7837773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7837814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7837884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7838037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7839045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7839220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7839261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7839797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7840201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7840339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7840379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7840449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7840616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7841578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7841751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7841791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7842352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7842756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7842880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7842928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7842998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7843152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7844103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7844294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7844335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7844947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7845351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7845472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7845512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7845583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7845736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7846722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7846898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7846941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7847520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7847938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7848059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7848099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7848172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7848331 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7849317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7849493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7849536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7850088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7850511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7850651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7850694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7850767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7850923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7851918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7852098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7852139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7852680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7853090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7853214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7853254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7853324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7853481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7854542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7854723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7854763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7855321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7855725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7855847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7855887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7855957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7856119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7857086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7857261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7857302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7857835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7858237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7858358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7858399 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7858469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7858630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7859619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7859792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7859832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7860366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7860773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7860897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7860934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7861004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7861158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7862123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7862292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7862333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7862869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7863284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7863403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7863443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7863510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7863672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7864664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7864842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7864882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7865435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7865841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7865965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7866006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7866073 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7866227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7867183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7867383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7867423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7867959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7868361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7868482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7868523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7868593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7868746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7869724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7869900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7869940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7870492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7870899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7871040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7871080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7871150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7871314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7872266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7872438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7872478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7873034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7873438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7873556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7873597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7873667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7873820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7874812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7874987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7875028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7875564 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7875968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7876103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7876143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7876211 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7876372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7877356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7877531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7877572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7878113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7878517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7878636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7878676 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7878746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7878897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7879859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7880029 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7880080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7880630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7881034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7881155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7881196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7881266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7881417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7882376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7882551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7882592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7883144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7883546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7883664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7883705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7883775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7883945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7884931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7885103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7885146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7885696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7886103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7886224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7886265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7886335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7886486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7887453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7887625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7887666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7888218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7888623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7888752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7888792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7888862 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7889013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7889975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7890148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7890191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7890724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7891131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7891253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7891293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7891363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7891514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7892481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7892654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7892694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7893257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7893659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7893780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7893818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7893888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7894039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7895049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7895225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7895268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7895801 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7896205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7896329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7896370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7896440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7896591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7897569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7897741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7897782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7898313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7898717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7898852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7898892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7898976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7899137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7900509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7900768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: E0 44 9C FE F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7901191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7901379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 3C 2C DE AC 11 EA C9 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7901770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7901961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 1C D7 00 96 11 EA C9 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7902368 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7902543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 0E 26 A5 F9 F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7903786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\System.Windows.Forms.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7903974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:14:14 AM, LastAccessTime: 10/11/2011 7:14:14 AM, LastWriteTime: 10/11/2011 7:14:14 AM, ChangeTime: 11/13/2011 6:54:11 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7904015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7904621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\System.Windows.Forms.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:43.7904891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7912204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7919367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7920048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x5e900000, Image Size: 0xbde000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7920339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7921660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7921883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7921927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7922490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7922918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7923069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7923112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7923188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7923379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7924352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7924524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7924562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7925109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7925543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7925680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7925721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7925791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7925963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7926952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7927125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7927165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7927736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7928141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7928262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7928300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7928370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7928523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7929483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7929655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7929695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7930261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7930666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7930787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7930824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7930903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7931059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7932059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7932239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7932282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7932864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7933271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7933393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7933433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7933500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7933654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7934635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7934818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7934858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7935473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7935944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7936071 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7936112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7936182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7936338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7937362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7937540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7937602 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7938262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7938690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7938822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7938866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7938954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7939119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7940100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7940278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7940318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7940860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7941267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7941388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7941428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7941498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7941652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7942638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7942813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7942854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7943422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7943829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7943961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7944002 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7944072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7944223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7945198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7945384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7945427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7945971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7946373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7946494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7946535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7946602 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7946753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7947726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7947901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7947939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7948505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7948909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7949030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7949070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7949138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7949289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7950243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7950415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7950453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7951005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7951412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7951550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7951590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7951660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7951811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7952778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7952951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7952989 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7953544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7953948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7954066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7954107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7954177 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7954328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7955301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7955495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7955535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7956085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7956492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7956613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7956664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7956731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7956893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7957839 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7958014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7958052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7958591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7958992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7959114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7959151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7959219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7959370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7960353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7960526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7960566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7961132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7961536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7961655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7961695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7961763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7961913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7962873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7963048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7963088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7963622 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7964023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7964145 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7964185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7964252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7964403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7965419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7965600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7965638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7966176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7966591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7966718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7966759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7966829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7966990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7967966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7968141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7968181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7968720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7969127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7969248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7969289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7969367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7969518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7970477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7970650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7970690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7971261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7971663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7971784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7971825 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7971895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7972046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7973018 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7973191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7973231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7973797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7974199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7974320 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7974360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7974428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7974579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7975551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7975729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7975767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7976309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7976718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7976837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7976877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7976947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7977098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7978106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7978278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7978319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7978871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7979275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7979397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7979434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7979505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7979666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7980634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7980803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7980844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7981404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7981809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7981930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7981970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7982048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7982202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7983186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7983361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7983401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7983940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7984360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7984482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7984522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7984589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7984743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7985735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7985910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7985950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7986503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7986907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7987028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7987066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7987136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7987287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7990157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7990569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\System.Windows.Forms.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.Windows.Forms.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7992040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.7992482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.8687889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System\2.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9010829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9012459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System\2.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9247296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9665933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.Drawing.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9667340 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9673039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\VERSION.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9674182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9674362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:19 AM, LastAccessTime: 11/20/2010 11:29:19 AM, LastWriteTime: 11/20/2010 11:29:19 AM, ChangeTime: 11/13/2011 6:54:02 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9674403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9675467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9675640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:19 AM, LastAccessTime: 11/20/2010 11:29:19 AM, LastWriteTime: 11/20/2010 11:29:19 AM, ChangeTime: 11/13/2011 6:54:02 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9675677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9708965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\en-us.nlp</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9712253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9712805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\DbgJITDebugLaunchSetting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9712881 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\DbgManagedDebugger</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9712953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9719477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9719809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: 11</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720111 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 1, Length: 288</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720340 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720507 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 100, Data: System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: B2 62 20 80 E0 47 04 0F A0 44 DD 21 A0 4F F1 0D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9720879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 120, Data: F6 93 BF 24 30 AB 5B 45 10 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11\NIDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 40, Data: C6 38 19 18 C5 E2 50 79 08 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\432ba598\f6e8397\11</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\10</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\10\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: System.Web,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\10\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 8194</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\10\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\10\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: AA 60 89 9F D7 B2 09 4A 91 73 3D F6 A2 ED 7D A2</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\10\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 56 93 46 FE F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9721819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\10</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3a6a696d\52d7076e\16</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3a6a696d\52d7076e\16\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 102, Data: System.DirectoryServices,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3a6a696d\52d7076e\16\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3a6a696d\52d7076e\16\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3a6a696d\52d7076e\16\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 13 41 E5 0E CE C0 63 41 86 8A BC 3B 84 B8 33 C0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3a6a696d\52d7076e\16\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: A1 07 A1 FE F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3a6a696d\52d7076e\16</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\13</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722843 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\13\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 100, Data: System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\13\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9722972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\13\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9723005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\13\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: B1 BD 60 97 D0 A0 9D 4E 8E 40 6B CF FB 25 84 F1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9723045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\13\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 35 E6 74 F4 F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9723088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\13</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9723638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 35 E6 74 F4 F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9724225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.DirectoryServices__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9724409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.DirectoryServices,2.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: A1 07 A1 FE F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9725037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9725209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 56 93 46 FE F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9726454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\System.Runtime.Remoting.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9726661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:14:01 AM, LastAccessTime: 10/11/2011 7:14:01 AM, LastWriteTime: 10/11/2011 7:14:01 AM, ChangeTime: 11/13/2011 6:54:09 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9726705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9727252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\System.Runtime.Remoting.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:45.9727524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4779677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4781003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4781685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x65030000, Image Size: 0xc1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4781930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4783210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4783434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4783477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4784035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4784471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4784625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4784665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4784741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4784927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4785921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4786099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4786139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4786689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4787107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4787228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4787266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4787336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4787492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4788586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4788804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4788847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4789448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4789885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4790014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4790055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4790127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4790295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4791262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4791445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4791486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4792033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4792439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4792561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4792601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4792669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4792822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4793811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4793986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4794027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4794576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4794997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4795121 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4795161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4795231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4795398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4796382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4796557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4796595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4797144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4797570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4797691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4797735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4797802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4797958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4798974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4799152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4799203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4799750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4800176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4800297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4800338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4800416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4800583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4801567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4801742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4801782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4802356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4802787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4802930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4802970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4803038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4803191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4804164 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4804350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4804391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4804948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4805366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4805487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4805525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4805595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4805759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4806743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4806916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4806956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4807495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4807899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4808020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4808061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4808128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4808282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4809233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4809416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4809457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4810009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4810411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4810532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4810572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4810640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4810793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4811742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4811914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4811955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4812510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4812930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4813051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4813092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4813159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4813324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4814275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4814445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4814485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4815019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4815417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4815539 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4815576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4815644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4815827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4816786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4816959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4816999 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4817538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4817942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4818074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4818112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4818182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4818333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4819322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4819494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4819535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4820087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4820494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4820613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4820653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4820721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4820874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4821828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4822001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4822052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4822585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4822987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4823108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4823146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4823213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4823364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4824321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4824493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4824531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4825083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4825501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4825622 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4825660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4825754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4825911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4826878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4827048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4827088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4827635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4828039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4828161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4828201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4828268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4828419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4829362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4829535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4829573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4830130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4830535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4830664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4830704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4830772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4830923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4831866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4832036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4832076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4832610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4833011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4833146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4833184 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4833254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4833405 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4834350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4834523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4834561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4835105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4835515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4835638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4835687 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4835765 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4835916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4836913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4837088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4837129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4837662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4838064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4838185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4838223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4838293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4838454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4839433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4839605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4839643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4840176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4840586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4840707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4840745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4840812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4840966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4841931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4842103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4842144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4842699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4843103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4843221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4843273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4843340 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4843491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4844450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4844623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4844663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4845199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4845601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4845733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4845776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4845846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4845997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4846954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4847123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4847164 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4847751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4848153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4848274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4848312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4848379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.4848530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5360720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5361612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.Runtime.Remoting.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5363019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5397950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Rpc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: Read/Write, Delete, Write DAC</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Rpc\MaxRpcSize</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Rpc</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398554 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 8, Data: TOM</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SYSTEM\Setup\OOBEInProgress</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SYSTEM\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5398950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5399042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SYSTEM\Setup\SystemSetupInProgress</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5399077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SYSTEM\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5399158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Windows NT\Rpc</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5399284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\SQMClient\Windows</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5399354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5399470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5399516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5402566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5584</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5429050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ws2_32.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5431190 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\ws2_32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76700000, Image Size: 0x35000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5433044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\nsi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76e30000, Image Size: 0x6000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5434270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5434458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5434501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5435108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5435525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5435652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5435692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5435776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5435938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5436905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5437075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5437113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5437649 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5438050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5438172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5438209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5438288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5438436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5439422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5439594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5439632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5440182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5440600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5440718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5440756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5440821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5440969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5441909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5442079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5442117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5442664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5443063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5443178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5443216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5443281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5443440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5444388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5444558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5444596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5445173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5445571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5445690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5445741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5445808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5445959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5446956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5447126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5447164 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5447689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5448091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5448209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5448247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5448315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5448476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5449454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5449630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5449667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5450247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5450651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5450772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5450810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5450885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5451036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5452028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5452203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5452241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5452790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5453195 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5453311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5453351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5453416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5453567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5454550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5454736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5454776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5455353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5455782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5455906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5455943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5456013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5456164 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5457194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5457388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5457425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5457970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5458371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5458490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5458528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5458592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5458740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5459697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5459867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5459902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5460438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5460848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5460969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5461007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5461071 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5461228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5462217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5462389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5462427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5462960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5463359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5463478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5463515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5463580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5463742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5464677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5464847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5464884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5465415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5465857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5465978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5466016 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5466084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5466232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5467229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5467401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5467439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5468002 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5468417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5468536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5468571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5468635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5468781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5469719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5469888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5469926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5470452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5470850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5470966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5471004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5471069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5471217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5472179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5472359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5472397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5472966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5473367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5473486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5473524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5473586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5473734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5474672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5474841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5474876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5475413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5475841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5475962 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5476003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5476081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5476229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5477240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5477417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5477466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5478032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5478436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5478555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5478592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5478657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5478805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5479759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5479926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5479964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5480492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5480894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5481012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5481050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5481115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5481263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5482225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5482395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5482432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5482987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5483384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5483516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5483553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5483615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5483764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5484701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5484871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5484909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5485440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5485857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5485979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5486016 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5486081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5486237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5487186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5487358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5487396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5487943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5488342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5488460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5488498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5488563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5488719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5489700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5489870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5489907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5490436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5490834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5490950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5490988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5491053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5491201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5492155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5492325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5492360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5492893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5493303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5493421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5493459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5493521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5493683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5494661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5494831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5494868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5495426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5495847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5495965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5496014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5496081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5496227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5497170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5497342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5497380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5497908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5498307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5498425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5498463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5498525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5498673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5499670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\SQMClient\Windows</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5499757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5499897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5499937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5500067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\WinSock2\Parameters</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5500134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\WinSock2\Parameters</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5500355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\WinSock_Registry_Version</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 8, Data: 2.0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5500401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\WinSock_Registry_Version</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 8, Data: 2.0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5500503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\AppId_Catalog</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5500767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\AppId_Catalog\25832456</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5500848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\AppId_Catalog</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5500899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Callout</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 70, Data: %SystemRoot%\System32\fwpuclnt.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5500942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Callout</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 70, Data: %SystemRoot%\System32\fwpuclnt.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5501023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5501215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Serial_Access_Num</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 119</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5501379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Serial_Access_Num</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 119</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5501444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\00000077</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5501497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Next_Catalog_Entry_ID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1735</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5501530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Num_Catalog_Entries</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 28</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5501584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5501783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5501985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502489 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5502918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503815 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5503971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5504968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505647 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5505941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000014</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5506970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000015</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000016</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5507792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000017</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5508388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5508579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5508660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5508727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000018</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5508808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000019</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000020</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000021</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5509913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000022</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000023</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000024</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5510940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000025</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000025\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000025\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000025</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000026</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000026\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000026\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000026</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000027</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000027\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000027\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000027</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5511918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000028</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000028\PackedCatalogItem</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000028\PackedCatalogItem</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 888, Data: 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000028</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Serial_Access_Num</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 16</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Serial_Access_Num</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 16</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\00000010</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Num_Catalog_Entries</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 6</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5512977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\NLAapi.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\NLAapi.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 80, Data: @%SystemRoot%\system32\nlasvc.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513260 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 80, Data: @%SystemRoot%\system32\nlasvc.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 80, Data: @%SystemRoot%\system32\nlasvc.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513330 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 80, Data: @%SystemRoot%\system32\nlasvc.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513368 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\ProviderId</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: 3A 24 42 66 A8 3B A6 4A BA A5 2E 0B D7 1F DD 83</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\AddressFamily</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\SupportedNameSpace</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 15</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Enabled</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\Version</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\StoresServiceClassInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 68, Data: %SystemRoot%\system32\napinsp.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 68, Data: %SystemRoot%\system32\napinsp.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\napinsp.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5513993 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\napinsp.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\napinsp.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\napinsp.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\ProviderId</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: A2 CB 4A 96 BC B2 EB 40 8C 6A A6 DB 40 16 1C AE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\AddressFamily</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\SupportedNameSpace</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 37</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514195 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Enabled</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\Version</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\StoresServiceClassInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 68, Data: %SystemRoot%\system32\pnrpnsp.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 68, Data: %SystemRoot%\system32\pnrpnsp.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\pnrpnsp.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\pnrpnsp.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\pnrpnsp.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\pnrpnsp.dll,-1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\ProviderId</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: CE 89 FE 03 6D 76 76 49 B9 C1 BB 9B C4 2C 7B 4D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\AddressFamily</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\SupportedNameSpace</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 39</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Enabled</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\Version</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5514995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\StoresServiceClassInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 68, Data: %SystemRoot%\system32\pnrpnsp.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 68, Data: %SystemRoot%\system32\pnrpnsp.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\pnrpnsp.dll,-1001</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\pnrpnsp.dll,-1001</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\pnrpnsp.dll,-1001</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515513 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: @%SystemRoot%\system32\pnrpnsp.dll,-1001</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\ProviderId</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: CD 89 FE 03 6D 76 76 49 B9 C1 BB 9B C4 2C 7B 4D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\AddressFamily</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\SupportedNameSpace</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 38</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\Enabled</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\Version</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\StoresServiceClassInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000004</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5515882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\mswsock.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 68, Data: %SystemRoot%\System32\mswsock.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 86, Data: @%SystemRoot%\system32\wshtcpip.dll,-60103</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 86, Data: @%SystemRoot%\system32\wshtcpip.dll,-60103</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 86, Data: @%SystemRoot%\system32\wshtcpip.dll,-60103</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 86, Data: @%SystemRoot%\system32\wshtcpip.dll,-60103</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\ProviderId</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: 40 9D 05 22 9E 7E CF 11 AE 5A 00 AA 00 A7 11 2B</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\AddressFamily</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\SupportedNameSpace</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 12</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\Enabled</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\Version</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\StoresServiceClassInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516488 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000005</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\System32\winrnr.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\LibraryPath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\System32\winrnr.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 10, Data: NTDS</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 10, Data: NTDS</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 10, Data: NTDS</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5516984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\DisplayString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 10, Data: NTDS</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\ProviderId</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: EE 37 26 3B 80 E5 CF 11 A5 55 00 C0 4F D8 D4 AC</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\AddressFamily</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\SupportedNameSpace</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 32</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\Enabled</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\Version</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\StoresServiceClassInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006\ProviderInfo</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000006</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Winsock2\Parameters</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Winsock2\Parameters</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Ws2_32NumHandleBuckets</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Ws2_32SpinCount</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5517730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5518800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5519021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallationType</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 14, Data: Client</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5519288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallationType</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 14, Data: Client</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5519504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5520980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5521406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:32 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5521444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5521999 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5522484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5522608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\mswsock.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5522764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5524567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x756a0000, Image Size: 0x3c000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5524661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5526154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5526332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5526370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5526946 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5527353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5527475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5527515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5527582 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5527739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5528703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5528876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5528911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5529455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5529857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5529973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5530010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5530072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5530220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5531158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5531328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5531366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5531910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5532309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5532427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5532465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5532530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5532675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5533645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5533815 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5533853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5534395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5534791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5534909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5534947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5535009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5535168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5536122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5536294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5536332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5536863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5537264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5537380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5537418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5537510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5537658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5538623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5538792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5538830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5539374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5539779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5539900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5539935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5540002 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5540169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5541161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5541344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5541382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5541942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5542357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5542476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5542511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5542576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5542724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5543699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5543880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5543918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5544475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5544877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5544996 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5545033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5545095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5545246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5546238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5546408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5546445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5546973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5547375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5547491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5547529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5547591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5547739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5548677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5548846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5548881 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5549418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5549816 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5549935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5549970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5550045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5550191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5551164 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5551334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5551371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5551916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5552317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5552433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5552471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5552535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5552681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5553616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5553802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5553840 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5554387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5554780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5554899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5554934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5554998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5555152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5556149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5556348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5556386 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5556974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5557383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5557502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5557539 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5557604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5557752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5558757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5558935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5558973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5559539 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5559938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5560059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5560099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5560161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5560318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5561274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5561444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5561482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5562013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5562412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5562549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5562595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5562659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5562808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5563764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5563934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5563972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5564500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5564896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5565015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5565052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5565117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5565263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5566235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5566408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5566446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5567009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5567408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5567523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5567561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5567623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5567779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5568747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5568917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5568954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5569493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5569897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5570032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5570070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5570135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5570283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5571229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5571396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5571433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5571964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5572374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5572498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5572536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5572600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5572746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5573710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5573880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5573918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5574465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5574861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5574980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5575017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5575090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5575236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5576225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5576394 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5576432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5576958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5577356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5577475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5577513 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5577575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5577723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5578663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5578833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5578871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5579415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5579814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5579930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5579965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5580030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5580183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5581159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5581328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5581366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5581908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5582309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5582425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5582460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5582525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5582673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5583619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5583786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5583824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5584349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5584759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5584877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5584915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5584977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5585123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5586093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5586260 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5586297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5586847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5587249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5587367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5587405 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5587478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5587626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5588558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5588725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5588763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5589291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5589693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5589809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5589846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5589919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5590075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5590790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\SQMClient\Windows</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5590870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5591002 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5591040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5591240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\Services\Winsock\Parameters</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5591304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Winsock\Parameters</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5591493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Parameters\Transports</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_MULTI_SZ, Length: 58, Data: Tcpip6, Psched, Tcpip, NetBIOS</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5591628 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Parameters\Transports</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_MULTI_SZ, Length: 58, Data: Tcpip6, Psched, Tcpip, NetBIOS</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5591665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Parameters</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5591754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5591819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock\Mapping</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 104, Data: 08 00 00 00 03 00 00 00 17 00 00 00 01 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock\Mapping</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 104, Data: 08 00 00 00 03 00 00 00 17 00 00 00 01 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Psched\Parameters\Winsock</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Psched\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Psched\Parameters\Winsock\Mapping</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Psched\Parameters\Winsock\Mapping</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Psched\Parameters\Winsock\Mapping</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 152, Data: 0C 00 00 00 03 00 00 00 17 00 00 00 01 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Psched\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Winsock\Setup Migration\Providers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592816 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers\Psched</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5592972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers\Psched\WinSock 2.0 Provider ID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: E0 A9 60 9D 7A 33 D0 11 BD 88 00 00 C0 82 E6 9A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers\Psched</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Winsock\Mapping</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 104, Data: 08 00 00 00 03 00 00 00 02 00 00 00 01 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Winsock\Mapping</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 104, Data: 08 00 00 00 03 00 00 00 02 00 00 00 01 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Winsock\Setup Migration\Providers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers\Tcpip</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5593969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers\Tcpip\WinSock 2.0 Provider ID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: A0 1A 0F E7 8B AB CF 11 8C A3 00 80 5F 48 A1 92</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5594015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers\Tcpip</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5594039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5594158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5594212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5594374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Winsock\MinSockaddrLength</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 16</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5594411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Winsock\MaxSockaddrLength</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 16</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5594441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Winsock\UseDelayedAcceptance</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5594476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Winsock\HelperDllName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 70, Data: %SystemRoot%\System32\wshtcpip.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5595352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wshtcpip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5595791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wshtcpip.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:12:08 PM, LastAccessTime: 7/13/2009 1:12:08 PM, LastWriteTime: 7/13/2009 3:16:20 PM, ChangeTime: 11/13/2011 6:57:05 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5595829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wshtcpip.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5596322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wshtcpip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5596796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\wshtcpip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5596920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\wshtcpip.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5597066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5598809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75a60000, Image Size: 0x5000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5598882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wshtcpip.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5600049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5600226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5600267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5600871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5601288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5601409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5601447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5601512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5601663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5602611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5602784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5602821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5603355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5603754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5603889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5603926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5603991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5604139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5605298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5605481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5605519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5606419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5606826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5606947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5606985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5607049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5607200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5608144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5608316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5608354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5608882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5609283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5609402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5609440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5609504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5609661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5610650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5610817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5610854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5611399 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5611798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5611916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5611954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5612019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5612167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5613166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5613344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5613382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5613932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5614355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5614476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5614511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5614576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5614727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5615691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5615888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5615926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5616500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5616912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5617031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5617068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5617136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5617281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5618249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5618432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5618467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5618995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5619394 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5619513 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5619548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5619612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5619769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5620714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5620884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5620922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5621466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5621865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5621984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5622021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5622086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5622242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5623210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5623379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5623417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5623964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5624360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5624479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5624517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5624581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5624738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5625694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5625891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5625929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5626486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5626888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5627017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5627055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5627120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5627268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5628254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5628427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5628464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5628998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5629413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5629532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5629569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5629631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5629779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5630731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5630900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5630949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5631474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5631871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5631989 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5632027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5632091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5632237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5633191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5633361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5633398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5633932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5634344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5634463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5634501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5634563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5634711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5635673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5635875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5635915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5636452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5636850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5636969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5637007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5637071 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5637220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5638176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5638346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5638384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5638915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5639313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5639443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5639478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5639542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5639688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5640682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5640852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5640890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5641442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5641844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5641960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5641997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5642062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5642216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5643172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5643342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5643380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5643916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5644312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5644431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5644468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5644546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5644695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5645654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5645840 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5645878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5646435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5646834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5646953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5646991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5647055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5647203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5648190 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5648362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5648400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5648925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5649327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5649445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5649480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5649545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5649693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5650639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5650809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5650844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5651375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5651771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5651890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5651935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5652000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5652146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5653110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5653283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5653318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5653843 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5654237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5654353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5654390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5654455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5654600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5655541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5655711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5655762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5656314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5656713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5656829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5656867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5656931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5657080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5658034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5658203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5658241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5658807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5659206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5659324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5659359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5659424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5659570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5660515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5660682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5660720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5661248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5661647 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5661763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5661801 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5661863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5662011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5662997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5663167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5663205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5663752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5664153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5664283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5664320 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5664385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5664547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Tcpip\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\Windows Error Reporting\Escalation</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\WMR</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\DisabledProcesses\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665687 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\853DC8F</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\DisabledSessions\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5665948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\DisabledSessions\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5666045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5666075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5666344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\DisabledSessions\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5666457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5666487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5666519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\DisabledSessions\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5666616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5666646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5667365 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\Services\Winsock\Parameters</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5667441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Winsock\Parameters</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5667637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Parameters\Transports</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_MULTI_SZ, Length: 58, Data: Tcpip6, Psched, Tcpip, NetBIOS</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5667683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Parameters\Transports</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_MULTI_SZ, Length: 58, Data: Tcpip6, Psched, Tcpip, NetBIOS</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5667716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Parameters</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5667799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5667856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock\Mapping</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 104, Data: 08 00 00 00 03 00 00 00 17 00 00 00 01 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock\Mapping</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 104, Data: 08 00 00 00 03 00 00 00 17 00 00 00 01 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\Services\Winsock\Setup Migration\Providers</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Winsock\Setup Migration\Providers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers\Tcpip6</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers\Tcpip6\WinSock 2.0 Provider ID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: C0 B0 EA F9 D4 26 D0 11 BB BF 00 AA 00 6C 34 E4</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers\Tcpip6</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\Winsock\Setup Migration\Providers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\Tcpip6\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5668969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock\MinSockaddrLength</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 28</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5669006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock\MaxSockaddrLength</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 28</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5669036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock\UseDelayedAcceptance</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5669063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock\HelperDllName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 66, Data: %SystemRoot%\System32\wship6.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5669920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5670338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:12:08 PM, LastAccessTime: 7/13/2009 1:12:08 PM, LastWriteTime: 7/13/2009 3:16:20 PM, ChangeTime: 11/13/2011 6:57:05 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5670375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5670858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5671335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5671453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\wship6.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5671604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5672332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75690000, Image Size: 0x6000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5672404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5673547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5673722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5673763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5674318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5674725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5674846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5674884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5674948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5675096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5676104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5676277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5676314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5676853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5677268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5677406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5677444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5677508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5677656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5678600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5678769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5678807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5679335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5679734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5679853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5679890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5679955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5680101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5681057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5681240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5681278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5681852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5682256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5682375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5682413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5682475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5682623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5683577 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5683747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5683784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5684312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5684717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5684835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5684873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5684946 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5685107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5686137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5686315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5686352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5686926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5687339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5687460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5687498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5687562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5687710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5688718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5688893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5688950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5689486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5689888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5690014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5690052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5690114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5690262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5691222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5691394 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5691432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5691973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5692372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5692491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5692529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5692591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5692750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5693744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5693916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5693965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5694493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5694889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5695008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5695045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5695107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5695256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5696237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5696409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5696447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5696975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5697390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5697508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5697546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5697611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5697775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5698743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5698929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5698966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5699535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5699931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5700052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5700090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5700155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5700303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5701238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5701410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5701445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5701974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5702372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5702502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5702537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5702601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5702750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5703706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5703876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5703914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5704463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5704865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5704984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5705019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5705083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5705229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5706210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5706382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5706420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5706961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5707358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5707473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5707511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5707576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5707732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5708694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5708864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5708902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5709438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5709834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5709953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5709990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5710055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5710201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5711200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5711370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5711408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5711936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5712329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5712448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5712486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5712550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5712699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5713636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5713806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5713844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5714375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5714768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5714887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5714935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5714997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5715153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5716161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5716334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5716371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5716924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5717342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5717460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5717495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5717560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5717708 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5718648 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5718818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5718856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5719398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5719794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5719910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5719947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5720009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5720158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5721098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5721270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5721308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5721847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5722262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5722381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5722416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5722480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5722629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5723618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5723787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5723822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5724350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5724747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5724865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5724900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5724965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5725110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5726099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5726269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5726307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5726838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5727237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5727355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5727393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5727468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5727614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5728595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5728764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5728802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5729344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5729740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5729858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5729896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5729961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5730106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5731044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5731214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5731252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5731796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5732192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5732311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5732346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5732410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5732556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5733502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5733672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5733709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5734294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5734693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5734811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5734846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5734914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5735059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5736046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5736215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5736253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5736784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5737185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5737304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5737339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5737404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5737560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5738048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\TCPIP6\Parameters\Winsock</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5738266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\Windows Error Reporting\Escalation</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5738371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\DisabledSessions\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5738500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5738535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5738568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\DisabledSessions\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5738670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5738697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5739613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5739853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: 2</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5739902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 1, Length: 288</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5739980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5740069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5740198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5740387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 94, Data: System.Configuration,2.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5740505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5740586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5740632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: 2D 5B CB EB 94 75 EF 62 18 9F 60 5B CC A1 CE C6</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5740689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5740818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5740958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5741023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5741079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 60, Data: 57 8D AB 19 D8 B0 D7 1B 04 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5741136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2\NIDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 40, Data: C6 38 19 18 C5 E2 50 79 08 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5741184 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5741219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\159a66b8\424bd4d8\2</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5743181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\System.Configuration.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5743372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:13:40 AM, LastAccessTime: 10/11/2011 7:13:40 AM, LastWriteTime: 10/11/2011 7:13:40 AM, ChangeTime: 11/13/2011 6:54:08 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5743413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5743955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\System.Configuration.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:46.5744235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0746598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0748207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0748859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x64390000, Image Size: 0xf1000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0749093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0750387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0750613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0750656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0751249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0751678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0751847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0751888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0751961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0752141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0753141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0753313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0753354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0753885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0754286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0754410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0754448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0754515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0754669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0755636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0755809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0755860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0756431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0756833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0756967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0757008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0757072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0757226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0758218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0758393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0758431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0758961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0759360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0759482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0759519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0759587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0759751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0760716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0760888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0760929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0761468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0761869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0761988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0762025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0762090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0762241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0763233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0763405 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0763445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0763995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0764416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0764545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0764601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0764669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0764822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0765766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0765935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0766059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0766658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0767078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0767199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0767240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0767310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0767463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0768514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0768692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0768732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0769279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0769694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0769832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0769870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0769937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0770107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0771115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0771298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0771338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0771920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0772327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0772448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0772489 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0772559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0772715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0773691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0773863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0773904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0774448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0774847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0774984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0775022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0775092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0775248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0776356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0776598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0776641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0777234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0777652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0777781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0777822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0777892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0778053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0779064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0779236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0779277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0779810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0780212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0780336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0780374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0780441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0780595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0781549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0781721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0781761 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0782311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0782715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0782837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0782874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0782952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0783103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0784076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0784249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0784286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0784823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0785224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0785343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0785383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0785450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0785601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0786574 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0786747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0786787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0787334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0787736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0787854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0787895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0787959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0788110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0789086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0789255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0789293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0789856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0790261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0790379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0790420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0790498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0790654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0791611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0791783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0791821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0792354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0792753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0792874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0792912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0792980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0793130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0794117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0794289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0794327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0794863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0795259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0795378 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0795418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0795496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0795647 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0796652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0796828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0796865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0797399 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0797800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0797919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0797959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0798027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0798188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0799140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0799312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0799353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0799926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0800328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0800447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0800487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0800552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0800713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0801678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0801851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0801888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0802419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0802821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0802939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0802977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0803044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0803195 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0804160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0804330 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0804370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0804901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0805300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0805418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0805456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0805523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0805674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0806696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0806868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0806906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0807458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0807924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0808067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0808110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0808188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0808339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0809293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0809463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0809501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0810042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0810444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0810565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0810603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0810670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0810821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0811775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0811945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0811985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0812532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0812931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0813050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0813087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0813155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0813306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0814284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0814454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0814494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0815022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0815424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0815542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0815580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0815650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.0815798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1043011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1049075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.Configuration.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1050522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1054863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 1, Length: 288</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: System.Xml,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: 13 0A D4 D9 71 9E 56 6C A9 33 AC 71 58 A0 42 03</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1055881 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 60, Data: EE 8F 63 75 AC 6C 56 07 0D 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1\NIDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 40, Data: C6 38 19 18 C5 E2 50 79 08 00 00 00 02 00 00 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\6faf58\19ab8d57\1</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\d</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\d\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 90, Data: System.Data.SqlXml,2.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\d\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056825 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\d\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\d\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 24 8F E8 3F FB 43 1E 4A A9 DD B7 75 4F 47 E6 F9</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\d\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 10 B0 A1 F8 F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1056940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\75638fee\7566cac\d</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1057727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Data.SqlXml__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1057924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Data.SqlXml,2.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 10 B0 A1 F8 F9 88 CB 01</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1059347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\System.Xml.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1059533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:13:45 AM, LastAccessTime: 10/11/2011 7:13:45 AM, LastWriteTime: 10/11/2011 7:13:46 AM, ChangeTime: 11/13/2011 6:54:12 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1059576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1060126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\System.Xml.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1060379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1061117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\System.Configuration.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1061276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:47.1061354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5624104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5625972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5626681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x63580000, Image Size: 0x536000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5626982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5628278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5628505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5628548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5629122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5629558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5629715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5629758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5629831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5630041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5631038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5631210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5631251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5631792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5632197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5632318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5632358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5632426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5632582 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5633574 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5633746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5633786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5634331 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5634732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5634854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5634894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5634975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5635128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5636117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5636293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5636333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5636955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5637365 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5637486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5637527 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5637594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5637750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5638718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5638890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5638931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5639494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5639898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5640019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5640060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5640127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5640283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5641332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5641518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5641558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5642116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5642558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5642679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5642722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5642800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5642957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5643970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5644145 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5644185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5644762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5645188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5645309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5645352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5645433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5645589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5646584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5646772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5646818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5647389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5647804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5647928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5647971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5648042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5648198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5649165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5649338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5649378 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5649933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5650335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5650464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5650504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5650575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5650744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5651720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5651898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5651941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5652509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5652916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5653038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5653081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5653148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5653312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5654299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5654479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5654520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5655086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5655487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5655606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5655646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5655716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5655870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5656907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5657088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5657128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5657681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5658079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5658201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5658241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5658308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5658459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5659448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5659621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5659661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5660208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5660610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5660744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5660785 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5660852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5661006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5661949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5662119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5662159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5662698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5663102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5663221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5663261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5663339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5663493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5664477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5664652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5664692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5665261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5665668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5665786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5665827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5665894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5666048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5667053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5667225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5667266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5667818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5668220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5668338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5668379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5668446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5668600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5669567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5669739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5669780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5670383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5670793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5670933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5670974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5671052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5671208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5672224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5672402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5672442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5673005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5673410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5673531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5673569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5673639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5673792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5674773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5674946 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5674986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5675517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5675918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5676040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5676080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5676147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5676312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5677312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5677484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5677524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5678080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5678495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5678618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5678659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5678729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5678893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5679845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5680017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5680057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5680599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5680998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5681116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5681157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5681227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5681378 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5682396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5682572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5682612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5683143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5683558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5683693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5683733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5683800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5683954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5684903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5685075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5685115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5685641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5686040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5686161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5686199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5686269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5686420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5687398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5687581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5687622 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5688185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5688589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5688710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5688751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5688821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5688974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5689931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5690106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5690146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5690683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5691090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5691208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5691249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5691316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5691480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5692450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5692626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5692666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5693205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5693620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5693744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5693784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5693852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.5694016 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6476710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6957105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.Xml.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6958951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6961516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\Policy\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6962521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6962688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:28:49 AM, LastAccessTime: 4/4/2014 2:45:25 PM, LastWriteTime: 4/4/2014 2:45:25 PM, ChangeTime: 4/4/2014 2:45:25 PM, AllocationSize: 98304, EndOfFile: 98304, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6962726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6962931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6963093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6963157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6963225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6964734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sorttbls.nlp</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6965383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sorttbls.nlp</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6965755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sorttbls.nlp</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 20,480, EndOfFile: 20,320, NumberOfLinks: 9, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6965828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sorttbls.nlp</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6965865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sorttbls.nlp</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 20,480, EndOfFile: 20,320, NumberOfLinks: 9, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6965936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTTBLS.NLP</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6967137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sortkey.nlp</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6967776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sortkey.nlp</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6968099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sortkey.nlp</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 266,240, EndOfFile: 262,148, NumberOfLinks: 9, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6968169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sortkey.nlp</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6968207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sortkey.nlp</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 266,240, EndOfFile: 262,148, NumberOfLinks: 9, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6968272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\SORTKEY.NLP</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6969735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6969913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 4:05:26 PM, LastAccessTime: 7/13/2009 4:05:26 PM, LastWriteTime: 7/13/2009 6:42:28 PM, ChangeTime: 11/13/2011 6:55:42 AM, AllocationSize: 28672, EndOfFile: 26035, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6969953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6971196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6971352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 4:05:26 PM, LastAccessTime: 7/13/2009 4:05:26 PM, LastWriteTime: 7/13/2009 6:42:28 PM, ChangeTime: 11/13/2011 6:55:42 AM, AllocationSize: 28672, EndOfFile: 26035, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6971390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6972573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6972934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6974066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 28,672, EndOfFile: 26,035, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6974400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6976523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,096, Length: 4,096</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6977146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 8,192, Length: 4,096</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6977569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 12,288, Length: 4,096</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6978000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 16,384, Length: 4,096</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6979266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 20,480, Length: 4,096</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6979654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 24,576, Length: 1,459</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6979816 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 26,035, Length: 4,096</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6979959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CONFIG\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6981603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6981791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 2/23/2007 6:15:02 PM, LastAccessTime: 4/2/2014 12:00:52 PM, LastWriteTime: 2/23/2007 6:15:02 PM, ChangeTime: 4/2/2014 12:00:52 PM, AllocationSize: 296, EndOfFile: 292, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6981829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6982807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6982969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 2/23/2007 6:15:02 PM, LastAccessTime: 4/2/2014 12:00:52 PM, LastWriteTime: 2/23/2007 6:15:02 PM, ChangeTime: 4/2/2014 12:00:52 PM, AllocationSize: 296, EndOfFile: 292, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6983004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6983645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6984022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6984408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 296, EndOfFile: 292, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6984459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 292</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6984790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 292, Length: 4,096</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6984888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6995656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\GLOBALIZATION\en.nlp</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996628 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 8, Data: TOM</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SYSTEM\Setup\OOBEInProgress</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SYSTEM\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6996998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SYSTEM\Setup\SystemSetupInProgress</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6997033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SYSTEM\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6997060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6997431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6997507 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\.NET CLR Networking\Performance</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6997803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\Library</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 28, Data: netfxperf.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6997863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\Library</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 28, Data: netfxperf.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6997922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\IsMultiInstance</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6998170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\IsMultiInstance</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6998232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\First Counter</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4160</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6998272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\First Counter</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4160</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6998342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6998784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6998857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\.net clr networking\Performance</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6999148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\CategoryOptions</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 3</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6999196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\CategoryOptions</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 3</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6999245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\FileMappingSize</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 131072</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6999280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\FileMappingSize</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 131072</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6999323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\Counter Names</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6999366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\Counter Names</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.6999399 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance\Counter Names</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 170, Data: 43 00 6F 00 6E 00 6E 00 65 00 63 00 74 00 69 00</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7002678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\.NET CLR Networking\Performance</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7006575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7007019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:19:03 AM, LastAccessTime: 10/10/2011 5:19:03 AM, LastWriteTime: 7/8/2011 6:29:46 PM, ChangeTime: 11/13/2011 6:56:58 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7007057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7007582 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7008170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7008307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7008345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 2,048, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7008418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7008542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7009593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7009994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:19:03 AM, LastAccessTime: 10/10/2011 5:19:03 AM, LastWriteTime: 7/8/2011 6:29:46 PM, ChangeTime: 11/13/2011 6:56:58 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7010045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7010563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7011134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7011261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7011296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 2,048, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7011363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7011479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\tzres.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7024349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\Windows Error Reporting\Escalation</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7024478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\DisabledSessions\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7024632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7024667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7024702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows\DisabledSessions\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7024807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7024839 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7129901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5608</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7136252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CRYPTSP.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7137112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CRYPTSP.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7137955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7138376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:37:21 PM, LastAccessTime: 7/13/2009 1:37:21 PM, LastWriteTime: 7/13/2009 3:15:07 PM, ChangeTime: 11/13/2011 6:56:15 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7138414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7138901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7139389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7139518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7139680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptsp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7142278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\cryptsp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x756e0000, Image Size: 0x16000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7142380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\CRYPTSP.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7143967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7144159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7144199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7144773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7145191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7145317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7145358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7145425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7145595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7146565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7146735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7146773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7147338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7147743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7147875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7147912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7147977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7148141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7149114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7149284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7149324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7149893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7150300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7150421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7150459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7150524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7150675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7151618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7151787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7151836 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7152396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7152798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7152917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7152954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7153022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7153183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7154159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7154329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7154369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7154932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7155334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7155452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7155493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7155557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7155706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7156713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7156953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7156994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7157551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7157966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7158112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7158158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7158233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7158384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7159376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7159546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7159586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7160120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7160537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7160669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7160707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7160774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7160931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7161898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7162070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7162111 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7162644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7163046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7163167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7163205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7163270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7163421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7164385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7164558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7164598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7165140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7165536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7165654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7165692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7165760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7165908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7166924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7167104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7167142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7167684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7168088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7168209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7168247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7168311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7168462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7169578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7169780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7169820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7170408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7170826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7170955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7170995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7171063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7171233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7172213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7172386 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7172426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7172992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7173399 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7173520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7173572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7173636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7173790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7174741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7174913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7174951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7175482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7175881 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7175997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7176034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7176102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7176250 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7177239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7177411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7177449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7177988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7178406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7178524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7178562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7178630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7178778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7179742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7179912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7179953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7180483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7180885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7181004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7181044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7181109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7181257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7182219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7182389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7182426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7182963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7183725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7183849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7183887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7183954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7184105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7185083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7185256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7185296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7185843 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7186242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7186374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7186428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7186493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7186644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7187619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7187792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7187832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7188384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7188794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7188913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7188950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7189018 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7189166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7190128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7190298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7190346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7190893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7191308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7191429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7191467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7191532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7191683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7192620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7192790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7192831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7193364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7193766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7193884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7193922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7193989 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7194148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7195118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7195288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7195326 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7195857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7196272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7196393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7196431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7196495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7196644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7197646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7197819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7197859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7198393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7198794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7198923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7198961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7199026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7199174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7200128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7200300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7200338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7200888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7201289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7201411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7201448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7201513 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7201661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7202615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7202788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7202842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7203424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7203825 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7203944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7203981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7204046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7204197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7205137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7205307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7205345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7205887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7206285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7206407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7206442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7206509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7206665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7207649 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7207819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7207856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7208401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7208802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7208921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7208959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7209026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7209174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7209964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 108, Data: Microsoft Enhanced RSA and AES Cryptographic Provider</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 108, Data: Microsoft Enhanced RSA and AES Cryptographic Provider</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 108, Data: Microsoft Enhanced RSA and AES Cryptographic Provider</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024\Name</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 108, Data: Microsoft Enhanced RSA and AES Cryptographic Provider</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 024</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Type</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 24</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\rsaenh.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\rsaenh.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\rsaenh.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7210877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider\Image Path</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\rsaenh.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7211775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7212200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:37:33 PM, LastAccessTime: 7/13/2009 1:37:33 PM, LastWriteTime: 7/13/2009 3:17:54 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7212238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7212720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7213300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7213418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7213456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 242,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7213529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7213712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7214593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7215003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:37:33 PM, LastAccessTime: 7/13/2009 1:37:33 PM, LastWriteTime: 7/13/2009 3:17:54 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7215038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7215512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7216078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7216188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7216223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 242,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7216294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7216474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7217390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7217789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:37:33 PM, LastAccessTime: 7/13/2009 1:37:33 PM, LastWriteTime: 7/13/2009 3:17:54 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7217827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7218301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7218867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7218977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7219013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 242,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7219083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7219266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7220144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7220549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:37:33 PM, LastAccessTime: 7/13/2009 1:37:33 PM, LastWriteTime: 7/13/2009 3:17:54 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7220584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7221061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7221629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7221740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7221777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 242,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7221845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7222028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7222238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\SafeProcessSearchMode</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 16</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7223044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7223448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:37:33 PM, LastAccessTime: 7/13/2009 1:37:33 PM, LastWriteTime: 7/13/2009 3:17:54 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7223499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7224054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7224634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7224771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 242,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7224833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7224868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 242,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7224933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7257458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7258913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7259320 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:37:33 PM, LastAccessTime: 7/13/2009 1:37:33 PM, LastWriteTime: 7/13/2009 3:17:54 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7259355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7259832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7260298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7260417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7260570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7262368 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75480000, Image Size: 0x3b000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7262478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7263928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7264114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7264154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7264726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7265141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7265267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7265308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7265378 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7265572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7266542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7266717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7266755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7267318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7267728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7267860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7267897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7267962 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7268124 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7269102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7269274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7269312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7269865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7270269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7270387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7270428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7270492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7270643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7271611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7271780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7271821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7272363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7272764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7272883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7272920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7272985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7273133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7274117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7274289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7274327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7274861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7275259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7275375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7275413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7275480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7275629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7276655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7276847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7276887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7277434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7277844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7277965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7278005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7278075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7278226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7279207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7279385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7279423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7279978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7280398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7280522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7280571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7280635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7280794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7281767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7281940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7281977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7282540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7282942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7283061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7283098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7283166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7283317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7284262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7284435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7284473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7285017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7285418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7285537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7285575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7285642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7285790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7286733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7286922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7286962 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7287518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7287916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7288038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7288075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7288143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7288291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7289275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7289447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7289485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7290016 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7290417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7290536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7290573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7290641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7290789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7291756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7291929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7291983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7292522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7292923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7293042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7293079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7293158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7293306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7294281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7294451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7294489 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7295022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7295419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7295540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7295577 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7295642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7295793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7296744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7296933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7296973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7297526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7297930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7298049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7298086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7298151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7298302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7299269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7299439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7299477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7300024 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7300425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7300560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7300598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7300662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7300813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7301778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7301948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7301986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7302516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7302918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7303036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7303074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7303139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7303298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7304265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7304435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7304475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7305022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7305421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7305540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7305580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7305656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7305804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7306782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7306987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7307027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7307564 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7307968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7308086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7308127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7308191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7308367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7309326 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7309512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7309552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7310099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7310501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7310617 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7310654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7310719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7310870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7311851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7312037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7312075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7312616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7313018 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7313136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7313174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7313241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7313392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7314357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7314529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7314567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7315101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7315497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7315615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7315653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7315718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7315869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7316863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7317044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7317084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7317618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7318019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7318140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7318178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7318245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7318407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7319396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7319566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7319606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7320145 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7320547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7320665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7320703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7320770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7320921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7321899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7322072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7322110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7322641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7323069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7323188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7323225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7323293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7323441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7324416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7324586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7324627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7325179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7325580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7325699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7325739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7325804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7325966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7326944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7327130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7327168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7327725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7328130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7328246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7328286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7328351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7328502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy\Enabled</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7329695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Cryptography</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCacheMaxItems</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330250 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Cryptography\PrivKeyCachePurgeIntervalSeconds</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Cryptography\PrivateKeyLifetimeSeconds</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Cryptography</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330377 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Cryptography</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: e6a475de-4040-4025-9397-ec55e0f69b59</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: e6a475de-4040-4025-9397-ec55e0f69b59</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: e6a475de-4040-4025-9397-ec55e0f69b59</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330628 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: e6a475de-4040-4025-9397-ec55e0f69b59</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7330803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Cryptography\Offload</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7331358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Cryptography\DESHashSessionKeyBackward</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7331466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7364533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\uxtheme.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7365918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\System.Windows.Forms.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7366193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\System.Windows.Forms.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7366327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\System.Windows.Forms.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7366613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7367909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\SYSTEM.WINDOWS.FORMS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x5e430000, Image Size: 0x4ce000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7367995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7368179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7368216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7368311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\System.Windows.Forms.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:18:58 AM, LastAccessTime: 10/10/2011 5:18:58 AM, LastWriteTime: 3/29/2011 12:33:52 PM, ChangeTime: 11/13/2011 6:54:04 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7774224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\SYSTEM.WINDOWS.FORMS\2.0.0.0__B77A5C561934E089\System.Windows.Forms.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7866634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\757b4e72\3be79c31</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7869832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CustomTooltip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7870021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/30/2005 2:02:52 AM, LastAccessTime: 4/2/2014 12:00:54 PM, LastWriteTime: 11/30/2005 2:02:52 AM, ChangeTime: 4/2/2014 12:00:54 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7870078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7870972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CustomTooltip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7871131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/30/2005 2:02:52 AM, LastAccessTime: 4/2/2014 12:00:54 PM, LastWriteTime: 11/30/2005 2:02:52 AM, ChangeTime: 4/2/2014 12:00:54 PM, AllocationSize: 20480, EndOfFile: 20480, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7871169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7871875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CustomTooltip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7872233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7872624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7872810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7873373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x11000000, Image Size: 0x8000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7873742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0xb80000, Image Size: 0x8000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7878609 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7878849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR\AppID\MKV2AC3.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7878957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCR</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7879035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\OLE\AppCompat</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7879186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7879229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole\AppCompat</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7879296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\OLE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7879428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole\DefaultAccessPermission</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7879479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7881215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7881306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7881473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7881530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Lsa</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7882255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5612</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7883287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7883521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Type</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7883575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\rsaenh.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7883616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\rsaenh.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7883659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\rsaenh.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7883694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider\Image Path</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: %SystemRoot%\system32\rsaenh.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7884028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Cryptography</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7884182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: e6a475de-4040-4025-9397-ec55e0f69b59</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7884225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: e6a475de-4040-4025-9397-ec55e0f69b59</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7884271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: e6a475de-4040-4025-9397-ec55e0f69b59</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7884306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\MachineGuid</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: e6a475de-4040-4025-9397-ec55e0f69b59</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7884384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7884473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Cryptography\Offload</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7884680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7884896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7885074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR\Interface\{00000134-0000-0000-C000-000000000046}</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7885198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCR</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7885265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: Read, Write DAC</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7885394 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCR\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 78, Data: {00000320-0000-0000-C000-000000000046}</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7885445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCR\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7885483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCR\Interface\{00000134-0000-0000-C000-000000000046}</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7885532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Rpc\Extensions</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7885656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 20, Data: Ole32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7885693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Rpc\Extensions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7886022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Rpc\Extensions</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7886151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 32, Data: RpcRtRemote.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7886216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Rpc\Extensions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7887132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\RpcRtRemote.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7887960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\RpcRtRemote.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7888833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7889013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7889056 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7889566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7889808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7889940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7890105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7890980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75ea0000, Image Size: 0xe000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7891094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7892616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7892807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7892848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7893408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7893818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7893950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7894007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7894085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7894252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7895268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7895451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7895494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7896082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7896499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7896626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7896666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7896739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7896947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7898027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7898216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7898259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7898871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7899302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7899436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7899480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7899555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7899736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7900768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7900945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7900991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7901560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7901988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7902115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7902158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7902231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7902393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7903398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7903576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7903629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7904187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7904605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7904734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7904777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7904853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7905023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7906030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7906216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7906259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7906828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7907278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7907415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7907459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7907531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7907701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7908717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7908898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7908941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7909493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7909905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7910032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7910089 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7910167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7910323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7911280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7911455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7911495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7912050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7912457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7912576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7912616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7912689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7912845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7913850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7914026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7914069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7914648 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7915063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7915198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7915246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7915319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7915478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7916462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7916634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7916677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7917246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7917658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7917779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7917820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7917893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7918046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7919024 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7919199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7919240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7919795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7920199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7920320 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7920361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7920444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7920601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7921555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7921730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7921773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7922317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7922721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7922843 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7922883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7922953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7923120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7924090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7924266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7924306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7924856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7925257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7925378 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7925419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7925492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7925648 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7926623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7926796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7926850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7927424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7927831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7927955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7927998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7928081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7928246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7929218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7929391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7929431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7929986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7930391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7930515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7930555 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7930628 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7930781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7931743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7931919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7931959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7932495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7932899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7933023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7933064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7933137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7933301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7934258 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7934430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7934473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7935026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7935430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7935551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7935591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7935664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7935829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7936831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7937030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7937074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7937637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7938052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7938176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7938216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7938289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7938442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7939423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7939596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7939639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7940181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7940590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7940714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7940755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7940825 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7940981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7941951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7942140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7942183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7942730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7943137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7943277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7943317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7943390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7943546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7944519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7944691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7944732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7945284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7945686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7945807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7945848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7945920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7946095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7947076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7947254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7947295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7947855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7948267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7948389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7948429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7948502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7948658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7949634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7949809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7949849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7950402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7950806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7950935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7950976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7951046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7951199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7952169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7952344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7952385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7952924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7953333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7953455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7953495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7953568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7953724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7954681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7954856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7954907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7955460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7955877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7956001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7956042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7956114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7956271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7957265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7957443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7957483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7958033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7958440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7958564 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7958604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7958677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7958833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7959580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\Services\BFE</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7959674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Services\BFE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7959917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\BFE</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7961668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5616</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7962967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5620</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7963975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7964190 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\CustomTooltip.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: CustomTooltip.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7964360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7965473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CustomTooltip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7965826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7966090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 20,480, EndOfFile: 20,480, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7966160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7966198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 20,480, EndOfFile: 20,480, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7966263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7966699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7967338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CustomTooltip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7967683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7967925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryInformationVolume</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>VolumeCreationTime: 11/13/2011 6:49:21 AM, VolumeSerialNumber: 2231-FB9D, SupportsObjects: True, VolumeLabel: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7967985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryAllInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>CreationTime: 11/30/2005 2:02:52 AM, LastAccessTime: 4/2/2014 12:00:54 PM, LastWriteTime: 11/30/2005 2:02:52 AM, ChangeTime: 4/2/2014 12:00:54 PM, FileAttributes: A, AllocationSize: 20,480, EndOfFile: 20,480, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x1a000000013b34, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7968041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryInformationVolume</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>VolumeCreationTime: 11/13/2011 6:49:21 AM, VolumeSerialNumber: 2231-FB9D, SupportsObjects: True, VolumeLabel: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7968084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryAllInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>CreationTime: 11/30/2005 2:02:52 AM, LastAccessTime: 4/2/2014 12:00:54 PM, LastWriteTime: 11/30/2005 2:02:52 AM, ChangeTime: 4/2/2014 12:00:54 PM, FileAttributes: A, AllocationSize: 20,480, EndOfFile: 20,480, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x1a000000013b34, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7968893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CustomTooltip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7969057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/30/2005 2:02:52 AM, LastAccessTime: 4/2/2014 12:00:54 PM, LastWriteTime: 11/30/2005 2:02:52 AM, ChangeTime: 4/2/2014 12:00:54 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7969098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7969580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CustomTooltip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:48.7969809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1005374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1005617 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1006196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x11000000, Image Size: 0x8000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1006450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1007692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1007905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1007950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1008514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1008937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1009085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1009128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1009201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1009371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1010346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1010519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1010578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1011281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1011728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1011861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1011904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1011976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1012146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1013135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1013316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1013356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1013911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1014337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1014458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1014499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1014569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1014728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1015717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1015892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1015930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1016479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1016894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1017045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1017088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1017161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1017342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1018352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1018530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1018570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1019123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1019543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1019670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1019721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1019802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1019972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1021004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1021184 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1021227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1021799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1022206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1022327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1022367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1022437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1022591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1023604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1023777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1023820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1024364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1024768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1024887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1024927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1024997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1025151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1026126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1026299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1026339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1026892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1027315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1027436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1027476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1027546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1027703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1028676 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1028851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1028891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1029444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1029850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1029972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1030009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1030080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1030244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1031201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1031373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1031413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1031952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1032357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1032478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1032529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1032596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1032750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1033707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1033876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1033917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1034472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1034879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1034997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1035035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1035105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1035259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1036215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1036391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1036431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1036989 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1037431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1037552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1037592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1037660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1037832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1038781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1038953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1038994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1039533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1039937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1040058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1040096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1040166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1040330 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1041306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1041481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1041521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1042060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1042464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1042583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1042623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1042691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1042844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1043831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1044003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1044044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1044577 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1044979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1045100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1045140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1045218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1045372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1046350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1046528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1046568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1047121 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1047525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1047649 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1047689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1047757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1047913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1048859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1049031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1049075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1049635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1050053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1050171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1050212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1050279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1050435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1051379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1051548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1051591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1052163 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1052572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1052694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1052734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1052818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1052974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1053941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1054114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1054154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1054693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1055095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1055216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1055254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1055324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1055477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1056458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1056631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1056671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1057242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1057649 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1057770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1057822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1057889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1058045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1059026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1059199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1059239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1059775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1060177 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1060298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1060338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1060406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1060559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1061524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1061697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1061740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1062281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1062688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1062807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1062845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1062912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1063076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1064052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1064227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1064267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1064806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1065213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1065332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1065372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1065442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1065596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1066569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1066744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1066784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1067353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1067760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1067897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1067938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1068008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1068161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1069110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1069282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1069323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1069872 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1070282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1070403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1070441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1070522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1070683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1071643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1071818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1071858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1072427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1072828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1072950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1072990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1073060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1073214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1073820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1074723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1077027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1101961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1102147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1102187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1102753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1103012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1103160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1103303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1103729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x70b00000, Image Size: 0x84000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1103812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1106849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1107218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1110307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1110482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1110751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1110956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tahoma</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1111023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1136435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\Gdiplus.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1136825 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1137655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1138871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1139043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:18 AM, LastAccessTime: 11/20/2010 11:29:18 AM, LastWriteTime: 11/20/2010 11:29:18 AM, ChangeTime: 11/13/2011 6:58:45 AM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1139083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1139760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1140760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\gdiplus.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1140935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:58:07 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1140972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1141506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\gdiplus.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1141757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1141889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1142058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1143438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x74be0000, Image Size: 0x190000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1143557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1145540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Hardware\DeviceMap\VIDEO</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read, Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1145712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\HARDWARE\DEVICEMAP\VIDEO\MaxObjectNumber</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 5</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1145774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\HARDWARE\DEVICEMAP\VIDEO</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1145845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Hardware\DeviceMap\Video</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1145958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\HARDWARE\DEVICEMAP\VIDEO\\Device\Video4</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 202, Data: \Registry\Machine\System\CurrentControlSet\Control\Video\{421CDBBA-E62D-4147-9702-EE0A1F51CECA}\0000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\CONTROL\VIDEO\{421CDBBA-E62D-4147-9702-EE0A1F51CECA}\0000</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\CONTROL\VIDEO\{421CDBBA-E62D-4147-9702-EE0A1F51CECA}\0000</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\HARDWARE\DEVICEMAP\VIDEO</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002\PruningMode</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 52</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0002</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146394 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028&amp;REV_A1\4&amp;932e434&amp;0&amp;0018</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028&amp;REV_A1\4&amp;932e434&amp;0&amp;0018\HardwareID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_MULTI_SZ, Length: 292, Data: PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028&amp;REV_A1, PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028, PCI\VEN_10DE&amp;DEV_01D1&amp;CC_030000, PCI\VEN_10DE&amp;DEV_01D1&amp;CC_0300</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028&amp;REV_A1\4&amp;932e434&amp;0&amp;0018</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146588 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028&amp;REV_A1\4&amp;932e434&amp;0&amp;0018</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028&amp;REV_A1\4&amp;932e434&amp;0&amp;0018\HardwareID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_MULTI_SZ, Length: 292, Data: PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028&amp;REV_A1, PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028, PCI\VEN_10DE&amp;DEV_01D1&amp;CC_030000, PCI\VEN_10DE&amp;DEV_01D1&amp;CC_0300</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Enum\PCI\VEN_10DE&amp;DEV_01D1&amp;SUBSYS_04051028&amp;REV_A1\4&amp;932e434&amp;0&amp;0018</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Hardware\DeviceMap\Video</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\HARDWARE\DEVICEMAP\VIDEO\\Device\Video4</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 202, Data: \Registry\Machine\System\CurrentControlSet\Control\Video\{421CDBBA-E62D-4147-9702-EE0A1F51CECA}\0000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1146895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\HARDWARE\DEVICEMAP\VIDEO</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1147890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5624</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1149318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1149550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts</Path>
<Result>SUCCESS</Result>
<Detail>Query: Cached, SubKeys: 0, Values: 368</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1149617 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1149736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCreateKey</Operation>
<Path>HKCU\Software\Microsoft\GDIPlus</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access, Disposition: REG_OPENED_EXISTING_KEY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1150048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\GDIPlus\FontCachePath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 60, Data: C:\Users\manono\AppData\Local</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1150652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read/Write, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1151035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1151366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\GDIPlus</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1151423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 94,208, EndOfFile: 94,064, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1151490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>FILE LOCKED WITH WRITERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1151738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 94,208, EndOfFile: 94,064, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1151813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1153285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS\ABAC.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1153721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\ABAC.TTF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 5/11/2004 2:33:10 AM, LastAccessTime: 12/12/2011 3:39:43 PM, LastWriteTime: 5/11/2004 2:33:10 AM, ChangeTime: 5/11/2004 2:33:10 AM, FileAttributes: RA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1153759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS\ABAC.TTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1156599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Users\manono\AppData\LOCAL\GDIPFONTCACHEV1.DAT</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1157494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1158095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1158394 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 700,416, EndOfFile: 700,180, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1158437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:19:00 AM, LastAccessTime: 10/10/2011 5:19:00 AM, LastWriteTime: 5/10/2011 12:33:44 PM, ChangeTime: 11/13/2011 6:54:58 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1158477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1159024 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1159598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1159819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:19:00 AM, LastAccessTime: 10/10/2011 5:19:00 AM, LastWriteTime: 5/10/2011 12:33:44 PM, ChangeTime: 11/13/2011 6:54:58 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1159857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 700,416, EndOfFile: 700,180, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1159916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1159951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 700,416, EndOfFile: 700,180, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1160019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Fonts\tahoma.ttf</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1160558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1161148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1161724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1161948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:19:00 AM, LastAccessTime: 10/10/2011 5:19:00 AM, LastWriteTime: 5/10/2011 12:33:44 PM, ChangeTime: 11/13/2011 6:54:58 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1161989 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 700,416, EndOfFile: 700,180, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1162042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1162080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 700,416, EndOfFile: 700,180, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1162156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Fonts\tahoma.ttf</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1164061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMA.TTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1164648 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1165241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1165535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 651,264, EndOfFile: 648,008, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1165575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:19:00 AM, LastAccessTime: 10/10/2011 5:19:00 AM, LastWriteTime: 1/16/2011 1:34:30 PM, ChangeTime: 11/13/2011 6:54:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1165613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1166087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1166680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1166909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:19:00 AM, LastAccessTime: 10/10/2011 5:19:00 AM, LastWriteTime: 1/16/2011 1:34:30 PM, ChangeTime: 11/13/2011 6:54:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1166950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 651,264, EndOfFile: 648,008, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1167020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1167057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 651,264, EndOfFile: 648,008, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1167127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Fonts\tahomabd.ttf</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1167572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1168151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1168733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1168954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:19:00 AM, LastAccessTime: 10/10/2011 5:19:00 AM, LastWriteTime: 1/16/2011 1:34:30 PM, ChangeTime: 11/13/2011 6:54:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1168995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 651,264, EndOfFile: 648,008, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1169049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1169084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 651,264, EndOfFile: 648,008, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1169148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Fonts\tahomabd.ttf</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1170962 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\FONTS\TAHOMABD.TTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1202735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\CTF\Compatibility\MKV2AC3.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1203196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1203404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1203452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1204495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\CTF\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1204729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\CTF\EnableAnchorContext</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1204775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\CTF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1205373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\CTF\KnownClasses</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1223981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\WindowsCodecs.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1224821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\WindowsCodecs.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1225635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1225802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:24 AM, LastAccessTime: 11/20/2010 11:29:24 AM, LastWriteTime: 11/20/2010 11:29:24 AM, ChangeTime: 11/13/2011 6:57:01 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1225843 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1226336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1226576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\SYSTEM32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1226710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\SYSTEM32\WindowsCodecs.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1226885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1228615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\SYSTEM32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x74810000, Image Size: 0xfb000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1228710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1230100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1230273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCU\Software\Classes</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1230332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1230391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1230623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCU\Software\Classes</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1230674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1230723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance\Disabled</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1230804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCR\CLSID\{FAE3D380-FEA4-4623-8C75-C6B61110B681}\Instance</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1388967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\English.ini</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Open No Recall, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1389487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 1,542, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1389722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 1,542, Length: 506</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1389797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 1,542, Length: 4,096</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1403815 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\LANG\ENGLISH.INI</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1406292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\fe0282\e9f3081</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1409450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\BaloonToolTip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1409625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/5/2007 2:32:14 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 7/5/2007 2:32:14 PM, ChangeTime: 4/2/2014 12:00:55 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1409665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1410541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\BaloonToolTip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1410700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/5/2007 2:32:14 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 7/5/2007 2:32:14 PM, ChangeTime: 4/2/2014 12:00:55 PM, AllocationSize: 16384, EndOfFile: 13312, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1410740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1411411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\BaloonToolTip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1411764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1412169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1412355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1412824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0xbd0000, Image Size: 0xc000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1413171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x2010000, Image Size: 0xc000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1414621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1414842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\BaloonToolTip.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: BaloonToolTip.INI</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1415012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1416063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\BaloonToolTip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1416424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1416696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 16,384, EndOfFile: 13,312, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1416763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1416804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 16,384, EndOfFile: 13,312, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1416876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1417289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1417930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\BaloonToolTip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1418280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1418523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryInformationVolume</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>VolumeCreationTime: 11/13/2011 6:49:21 AM, VolumeSerialNumber: 2231-FB9D, SupportsObjects: True, VolumeLabel: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1418585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryAllInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>CreationTime: 7/5/2007 2:32:14 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 7/5/2007 2:32:14 PM, ChangeTime: 4/2/2014 12:00:55 PM, FileAttributes: A, AllocationSize: 16,384, EndOfFile: 13,312, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x1a000000013b52, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1418644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryInformationVolume</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>VolumeCreationTime: 11/13/2011 6:49:21 AM, VolumeSerialNumber: 2231-FB9D, SupportsObjects: True, VolumeLabel: </Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1418685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryAllInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>CreationTime: 7/5/2007 2:32:14 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 7/5/2007 2:32:14 PM, ChangeTime: 4/2/2014 12:00:55 PM, FileAttributes: A, AllocationSize: 16,384, EndOfFile: 13,312, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x1a000000013b52, EaSize: 0, Access: Generic Read, Position: 0, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1419528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\BaloonToolTip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1419698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/5/2007 2:32:14 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 7/5/2007 2:32:14 PM, ChangeTime: 4/2/2014 12:00:55 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1419749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1420277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\BaloonToolTip.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.1420512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2753736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2753914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2754507 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0xbd0000, Image Size: 0xc000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2754771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2755498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2756482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2890215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2890676 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 10:46:18 AM, LastAccessTime: 7/13/2009 10:46:18 AM, LastWriteTime: 6/10/2009 11:22:50 AM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2890719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2891218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2891730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2891907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2892069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2892942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\Culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x60340000, Image Size: 0x8000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2893036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2893346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2893578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2893624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2894063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2894667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2894777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 10:46:18 AM, LastAccessTime: 7/13/2009 10:46:18 AM, LastWriteTime: 6/10/2009 11:22:50 AM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2915271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\culture.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2915594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2916408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2917841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2918017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:10 AM, LastAccessTime: 11/20/2010 11:29:10 AM, LastWriteTime: 11/20/2010 11:29:10 AM, ChangeTime: 11/13/2011 6:58:45 AM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2918057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2918731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2920078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2920806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2921393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll.DLL</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2921967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2922501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll.DLL</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2923463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2923918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 10:46:26 AM, LastAccessTime: 7/13/2009 10:46:26 AM, LastWriteTime: 6/10/2009 11:23:08 AM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2923958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2924492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2925104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2925427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorrc.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2925486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 344,064, EndOfFile: 342,352, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2925562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2925710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2953366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2955562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2955705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2955813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2955942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956330 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2956996 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2957120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\ExclusionList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2957219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\ExclusionList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2957314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2957397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\ExclusionList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2957497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\InclusionList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2957591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting\InclusionList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2957685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2957769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\PCHealth\ErrorReporting\InclusionList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2958928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2959103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2959141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2960033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2960186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2960221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2961245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2961401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2961439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2962299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2962452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/30/2012 8:17:44 PM, LastAccessTime: 4/2/2014 12:00:55 PM, LastWriteTime: 10/30/2012 8:17:44 PM, ChangeTime: 4/2/2014 2:59:56 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2962487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2963390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\Policy\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2964349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2964508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/10/2011 5:28:49 AM, LastAccessTime: 4/4/2014 2:45:25 PM, LastWriteTime: 4/4/2014 2:45:25 PM, ChangeTime: 4/4/2014 2:45:25 PM, AllocationSize: 98304, EndOfFile: 98304, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2964546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2964740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2964899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2965020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2965085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2965683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2966187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2966333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2966473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2966608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dw20.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value, Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.2966990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,024, Length: 23,040, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3397315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3398991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3399395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3399481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3399807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Process Create</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>PID: 5636, Command line: dw20.exe -x -s 868</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3399964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value, Set Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value, Set Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 80</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\AuthenticodeEnabled</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Windows\AppCompat</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3400934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QuerySecurityFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Information: Owner, Group, DACL, SACL, Label</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3401007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 10:46:20 AM, LastAccessTime: 7/13/2009 10:46:20 AM, LastWriteTime: 6/10/2009 11:22:52 AM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3401117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3401271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3401397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 16</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3401438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3401476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3401616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\dw20.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3402578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x10000000, Image Size: 0x9000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3403092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3403715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3403971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3404030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3404065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3404130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3404213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3404801 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3405178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: dw20.exe, 1: dw20.exe</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3405604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3407603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3408018 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 10:46:20 AM, LastAccessTime: 7/13/2009 10:46:20 AM, LastWriteTime: 6/10/2009 11:22:52 AM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3408053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3408288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3408487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Filter: Windows, 1: Windows</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3408681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3409204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3409393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: dw20.exe, 1: dw20.exe</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3409579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3409824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3410007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 146, Data: C:\Users\manono\AppData\Local\Microsoft\Windows\Temporary Internet Files</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3410069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3410112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3410244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3410303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3410376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3410503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3410538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3410578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\dw20.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3411411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\v2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3411608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\*</Path>
<Result>SUCCESS</Result>
<Detail>Filter: *, 1: .</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3411874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>0: .., 1: 1033, 2: Accessibility.dll, 3: AdoNetDiag.dll, 4: adonetdiag.mof, 5: alink.dll, 6: AppLaunch.exe, 7: ASP.NETWebAdminFiles, 8: Aspnet.config, 9: aspnet.mof, 10: aspnet.mof.uninstall, 11: AspNetMMCExt.dll, 12: aspnet_compiler.exe, 13: aspnet_filter.dll, 14: aspnet_isapi.dll, 15: Aspnet_perf.dll, 16: aspnet_perf.h, 17: aspnet_perf.ini, 18: aspnet_perf2.ini, 19: aspnet_rc.dll, 20: aspnet_regbrowsers.exe, 21: aspnet_regiis.exe, 22: aspnet_regsql.exe, 23: Aspnet_regsql.exe.config, 24: aspnet_state.exe, 25: aspnet_state_perf.h, 26: aspnet_state_perf.ini, 27: aspnet_wp.exe, 28: big5.nlp, 29: bopomofo.nlp, 30: CasPol.exe, 31: caspol.exe.config</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3412465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>0: CLR.mof, 1: CLR.mof.uninstall, 2: CONFIG, 3: CORPerfMonExt.dll, 4: csc.exe, 5: csc.exe.config, 6: csc.rsp, 7: cscomp.dll, 8: cscompmgd.dll, 9: Culture.dll, 10: CustomMarshalers.dll, 11: cvtres.exe, 12: dfdll.dll, 13: dfsvc.exe, 14: diasymreader.dll, 15: dv_aspnetmmc.chm, 16: dw20.exe, 17: EventLogMessages.dll, 18: fusion.dll, 19: IEExec.exe, 20: ieexec.exe.config, 21: IEExecRemote.dll, 22: IEHost.dll, 23: IIEHost.dll, 24: ilasm.exe, 25: ilasm.exe.config, 26: InstallCommon.sql, 27: InstallMembership.sql, 28: InstallPersistSqlState.sql, 29: InstallPersonalization.sql, 30: InstallProfile.SQL, 31: InstallRoles.sql</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3413044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>0: InstallSqlState.sql, 1: InstallSqlStateTemplate.sql, 2: InstallUtil.exe, 3: InstallUtilLib.dll, 4: InstallWebEventSqlProvider.sql, 5: ISymWrapper.dll, 6: jsc.exe, 7: jsc.exe.config, 8: ksc.nlp, 9: Microsoft.Build.Engine.dll, 10: Microsoft.Build.Framework.dll, 11: Microsoft.Build.Tasks.dll, 12: Microsoft.Build.Utilities.dll, 13: Microsoft.Build.xsd, 14: Microsoft.Common.targets, 15: Microsoft.Common.Tasks, 16: Microsoft.CSharp.targets, 17: Microsoft.JScript.dll, 18: Microsoft.JScript.tlb, 19: Microsoft.VisualBasic.Compatibility.Data.dll, 20: Microsoft.VisualBasic.Compatibility.dll, 21: Microsoft.VisualBasic.dll, 22: Microsoft.VisualBasic.targets, 23: Microsoft.VisualBasic.Vsa.dll, 24: Microsoft.VisualC.Dll, 25: Microsoft.Vsa.dll, 26: Microsoft.Vsa.tlb, 27: Microsoft.Vsa.Vb.CodeDOMProcessor.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3413639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>0: Microsoft.Vsa.Vb.CodeDOMProcessor.tlb, 1: Microsoft.WinFX.targets, 2: Microsoft_VsaVb.dll, 3: MmcAspExt.dll, 4: MSBuild, 5: MSBuild.exe, 6: msbuild.exe.config, 7: MSBuild.rsp, 8: mscordacwks.dll, 9: mscordbc.dll, 10: mscordbi.dll, 11: mscoree.tlb, 12: mscorie.dll, 13: mscorjit.dll, 14: mscorld.dll, 15: mscorlib.dll, 16: mscorlib.tlb, 17: mscorpe.dll, 18: mscorrc.dll, 19: mscorsec.dll, 20: mscorsn.dll, 21: mscorsvc.dll, 22: mscorsvw.exe, 23: mscortim.dll, 24: mscorwks.dll, 25: MUI, 26: ngen.exe, 27: ngen.log, 28: ngen_service.log, 29: normalization.dll, 30: normidna.nlp, 31: normnfc.nlp, 32: normnfd.nlp</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3414011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>0: normnfkc.nlp, 1: normnfkd.nlp, 2: PerfCounter.dll, 3: peverify.dll, 4: prc.nlp, 5: prcp.nlp, 6: RedistList, 7: RegAsm.exe, 8: regasm.exe.config, 9: RegSvcs.exe, 10: regsvcs.exe.config, 11: repository, 12: sbscmp20_mscorlib.dll, 13: shfusion.chm, 14: shfusion.dll, 15: ShFusRes.dll, 16: sortkey.nlp, 17: sorttbls.nlp, 18: SOS.dll, 19: SubsetList, 20: sysglobl.dll, 21: System.configuration.dll, 22: System.Configuration.Install.dll, 23: System.Data.dll, 24: System.Data.OracleClient.dll, 25: System.Data.SqlXml.dll, 26: System.Deployment.dll, 27: System.Design.dll, 28: System.DirectoryServices.dll, 29: System.DirectoryServices.Protocols.dll, 30: System.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3414416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>0: System.Drawing.Design.dll, 1: System.Drawing.dll, 2: System.Drawing.tlb, 3: System.EnterpriseServices.dll, 4: System.EnterpriseServices.Thunk.dll, 5: System.EnterpriseServices.tlb, 6: System.EnterpriseServices.Wrapper.dll, 7: System.Management.dll, 8: System.Messaging.dll, 9: System.Runtime.Remoting.dll, 10: System.Runtime.Serialization.Formatters.Soap.dll, 11: System.Security.dll, 12: System.ServiceProcess.dll, 13: System.tlb, 14: System.Transactions.dll, 15: System.Web.dll, 16: System.Web.Mobile.dll, 17: System.Web.RegularExpressions.dll, 18: System.Web.Services.dll, 19: System.Web.tlb, 20: System.Windows.Forms.dll, 21: System.Windows.Forms.tlb, 22: System.XML.dll, 23: TLBREF.DLL, 24: UninstallCommon.sql, 25: UninstallMembership.sql, 26: UninstallPersistSqlState.sql, 27: UninstallPersonalization.sql</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3415087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail>0: UnInstallProfile.SQL, 1: UninstallRoles.sql, 2: UninstallSqlState.sql, 3: UninstallSqlStateTemplate.sql, 4: UninstallWebEventSqlProvider.sql, 5: vbc.exe, 6: vbc.exe.config, 7: vbc.rsp, 8: vsavb7.olb, 9: VsaVb7rt.dll, 10: webengine.dll, 11: WMINet_Utils.dll, 12: xjis.nlp, 13: XPThemes.manifest</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3415410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>NO MORE FILES</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3415496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3416232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3416833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3416938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 36,864, EndOfFile: 33,096, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3416981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 36,864, EndOfFile: 33,096, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3417021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 26,112, Length: 1,024, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3417283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3434074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\ui\SwDRM.dll</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3452605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QuerySecurityFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>Information: Owner, Group, DACL, SACL, Label</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3452681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 10:46:20 AM, LastAccessTime: 7/13/2009 10:46:20 AM, LastWriteTime: 6/10/2009 11:22:52 AM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3453594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3453793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value, Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3453958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DisableLocalOverride</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3453998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3454128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3454160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3475874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3476496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3476701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3476758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3476793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3476858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3476941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3477324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3477995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3478577 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3478771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3478827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3478862 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3478924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3479003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3479563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\APPPATCH\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:49.3479779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\dw20.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6210421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,901,568, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6315698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCU\Software\Classes</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6315800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6315927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: Read, Write DAC</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6316264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6316372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6316431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 24, Data: mscoree.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6316487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6316566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6316611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 24, Data: mscoree.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6316654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6316989 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 62,464, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.6838877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 148,480, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7352285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCU\Software\Classes</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7352366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7352428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: Read, Write DAC</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7352657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7352757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7352811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 34, Data: diasymreader.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7352864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7352940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7352986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server\(Default)</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 34, Data: diasymreader.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7353075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 250,880, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7926591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Server</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7927580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7928844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:20 AM, LastAccessTime: 11/20/2010 11:29:20 AM, LastWriteTime: 11/20/2010 11:29:20 AM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7928887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7929407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7929650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7929774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7929809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 573,440, EndOfFile: 572,760, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.7929857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8109190 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8109756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Load Image</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x5e3a0000, Image Size: 0x8d000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8109867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 234,496, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8482247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8482411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 538,624, Length: 2,048, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8958975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8959161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8959198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8959673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8960042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8960147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:20 AM, LastAccessTime: 11/20/2010 11:29:20 AM, LastWriteTime: 11/20/2010 11:29:20 AM, ChangeTime: 11/13/2011 6:55:41 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8980548 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.8980853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 500,736, Length: 31,744, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.9338151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,024, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.9788020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.9788869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.9790111 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.9790278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:10 AM, LastAccessTime: 11/20/2010 11:29:10 AM, LastWriteTime: 11/20/2010 11:29:10 AM, ChangeTime: 11/13/2011 6:58:45 AM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.9790319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.9790968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:52.9792272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 532,480, Length: 6,144, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.0146183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 164,864, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.0474033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 115,712, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.0801570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 82,944, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.1007428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 148,480, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.1030721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 201,728, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.1058037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 50,176, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.1062888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.PDB</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.1063117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 3,355,648, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.1249974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,160,192, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.1786069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 33,792, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.2077389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 361,472, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.2608922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.2609372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 204,800, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3070691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3070885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 128, Length: 512, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3070979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 376, Length: 512, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3071063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 416, Length: 512, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3071144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 733,184, Length: 512, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3071252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 414,720, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3281275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 733,212, Length: 512, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3281865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.pdb</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3282078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 291,840, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3681659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 151,552, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3685283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\symbols\exe\MKV2AC3.pdb</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3685835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\exe\MKV2AC3.pdb</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3686512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\MKV2AC3.pdb</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3686857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.3687226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,499,584, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4155810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,781,056, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4415392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCU\Software\Classes</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4415481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4415551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: Read, Write DAC</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4415799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4415907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4415963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 24, Data: mscoree.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4416007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>SUCCESS</Result>
<Detail>Query: Name</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4416085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Classes\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4416133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32\(Default)</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 24, Data: mscoree.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4416174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCR\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4417343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4417745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4417963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,096, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4418125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 128, Length: 512</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4418178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 376, Length: 512</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4418222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 416, Length: 512</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4418262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 581,632, Length: 512</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4418335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 581,632, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4974794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 581,660, Length: 512</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4975373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.pdb</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4976020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\symbols\dll\Microsoft.VisualBasic.pdb</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4976543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\dll\Microsoft.VisualBasic.pdb</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4977195 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS\Microsoft.VisualBasic.pdb</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4977540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.4978550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 3,044,352, Length: 28,672, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.5551156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,588,544, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.6053162 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,408,320, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.6589082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,441,088, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.7259118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,065,984, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.7998440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,917,376, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.8539297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,700,864, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.8962890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 910,336, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:53.9535011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 1,246,208, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.0016591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 2,851,840, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.0531942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,420,032, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1035291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 5,391,360, Length: 28,672, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1587808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5528, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1587818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5532, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1587824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5584, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1587913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5620, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1587915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5524, User Time: 0.0780005, Kernel Time: 0.2028013</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1588042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5624, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1588047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5612, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1588096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5616, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1588153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5608, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1593087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1593275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\CustomTooltip.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1593429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\BaloonToolTip.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1593644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1593857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\BaloonToolTip.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1594008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\CustomTooltip.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1594178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\diasymreader.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1594332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\6E592E424A204AAFEADBE22B6B31B9DB\SYSTEM.WINDOWS.FORMS.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\6e592e424a204aafeadbe22b6b31b9db\System.Windows.Forms.ni.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1594458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\MSCORLIB\A1A82DB68B3BADC7C27EA1F6579D22C5\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\a1a82db68b3badc7c27ea1f6579d22c5\mscorlib.ni.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1594579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.XML\130AD4D9719E566CA933AC7158A04203\SYSTEM.XML.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\130ad4d9719e566ca933ac7158a04203\System.Xml.ni.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1594711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1594846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.CONFIGURATION\2D5BCBEB9475EF62189F605BCCA1CEC6\SYSTEM.CONFIGURATION.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\2d5bcbeb9475ef62189f605bcca1cec6\System.Configuration.ni.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1595116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\3B2CFD85528A27EB71DC41D8067359A1\SYSTEM.DRAWING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\3b2cfd85528a27eb71dc41d8067359a1\System.Drawing.ni.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1595339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.RUNTIME.REMO#\B2622080E047040FA044DD21A04FF10D\SYSTEM.RUNTIME.REMOTING.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\b2622080e047040fa044dd21a04ff10d\System.Runtime.Remoting.ni.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1595617 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\AppPatch\AcGenral.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1595849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\MICROSOFT.VISUALBASIC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1596053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\APPPATCH\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\AppPatch\AcXtrnal.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1596202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1596444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\AppPatch\AcLayers.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1596579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\mscoree.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1596700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1596832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\mpr.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1597096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\sfc_os.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1597228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\sfc.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1597347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\winspool.drv</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1597468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1597587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\AVAST Software\Avast\snxhk.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1597713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\SYSTEM32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\SortServer2003Compat.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1597837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC\MSVCR80.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1597972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\shunimpl.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1598325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\msacm32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1598454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\winmm.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1598573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\samcli.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1598692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\WindowsCodecs.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\WindowsCodecs.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1598810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\dwmapi.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1598929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80\GDIPLUS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1599053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\rsaenh.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1599185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\wship6.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\wship6.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1599608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\mswsock.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\mswsock.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1599740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\cryptsp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\cryptsp.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1599858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\uxtheme.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1599977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\version.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1600093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\WSHTCPIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\WSHTCPIP.DLL</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1600211 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\userenv.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1600333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\sspicli.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1600457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\apphelp.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1600583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\cryptbase.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1600958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\RpcRtRemote.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1601082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\profapi.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1601198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\cfgmgr32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1601311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\devobj.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1601427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\KernelBase.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1601545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\oleaut32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1601661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\setupapi.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1601788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\kernel32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1602044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\usp10.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1602170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\lpk.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1602289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\normaliz.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1602410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\gdi32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1602529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\imm32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1602650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\sechost.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1602769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\shlwapi.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1602901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ws2_32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ws2_32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1603019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\msvcrt.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1603141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\urlmon.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1603593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\wininet.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1603728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\iertutil.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1603847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ole32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1603965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\nsi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\nsi.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1604081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\msctf.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1604200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\user32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1604318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\rpcrt4.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1604442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\shell32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1604566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ntdll.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1604833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\advapi32.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1604970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\apisetschema.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1605094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\ABAB08AFA60A6F06BDDE0FCC9649C379\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v2.0.50727_32\System\abab08afa60a6f06bdde0fcc9649c379\System.ni.dll</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1605776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>Process Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Exit Status: -532459699, User Time: 0.0780005 seconds, Kernel Time: 0.2028013 seconds, Private Bytes: 24,735,744, Peak Private Bytes: 24,772,608, Working Set: 29,274,112, Peak Working Set: 29,401,088</Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1605835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\NetworkProvider\HwOrder</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1606991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1607016 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1607051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\index22c.dat</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1607215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1607250 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\pubpol4.dat</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1607385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_MSIL\MICROSOFT.VISUALBASIC\8.0.0.0__B03F5F7F11D50A3A\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1607519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1608126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\Protocol_Catalog9</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1608169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\WinSock2\Parameters\NameSpace_Catalog5</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1608239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sorttbls.nlp</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1608349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\ASSEMBLY\GAC_32\MSCORLIB\2.0.0.0__B77A5C561934E089\sortkey.nlp</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1609042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\CUSTOMTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1609309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.17514_NONE_72D18A4386696C80</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1609460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Classes</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1609516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\BALOONTOOLTIP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1609646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>CloseFile</Operation>
<Path>C:\WINDOWS\winsxs\X86_MICROSOFT.VC80.CRT_1FC8B3B9A1E18E3B_8.0.50727.4940_NONE_D08CC06A442B34FC</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1609856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1609902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>71</ProcessIndex>
<Time_of_Day>6:30:54.1609939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>5520</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>
</eventlist></procmon>